JP2007257657A - Distributed control apparatus, system, and controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a controller having various control functions in a distributed control system. <P>SOLUTION: The controller comprises a plurality of processors for executing numerical operation, sequence operation, neural network (NN), fuzzy and other controls. The controller is miniaturized by an LSI technique. Moreover, processor functions and I/O functions are programmable so that flexibility can be increased. A standard program whose programming is simple and a learning model such as NN are integrated for weighting and adding a plurality of calculated outputs to generate output data. Also, the value of weighting is updated according to learning. Thus, it is possible to implement a distributed control system having various control functions such as numerical operation control, sequence control, NN-applied control and fuzzy-applied control, and a controller for use therein. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a distributed control system that performs distributed control using a plurality of control devices (controllers) in various process control, plant control, vehicle control, and the like.

  Conventional examples of plant control systems include a distributed control system that performs control by distributing a plurality of controllers, and a control system called DCS (Distributed Control System). This DCS is intended to control a plant by connecting a plurality of controllers and an operator's console as a man-machine system through a network. However, even in a distributed system, the controller itself is usually placed centrally in a dedicated installation space called an instrument room, electrical room, or computer room, and I / O cables are connected to plant sensors or actuators from there. It was. However, this method has a problem that a dedicated installation space for the controller is required, and that it is expensive to install the connection cable between the input / output of the controller and the plant.

  In addition, when conventional controllers are arranged in a distributed manner, there is a problem that maintenance cannot be performed immediately when a controller fails.

  In general, one plant is composed of a plurality of control target groups, and one control target group is composed of a plurality of control target devices. Thus, it has been discussed in the past how many devices to be controlled with a single controller. In general, the smaller the number of devices to be controlled by a single controller, the smaller the influence range of a single controller will be and its risk distribution will be reduced, but the communication volume between controllers will increase. There was a problem.

  On the other hand, the advancement of control will continue to progress in the future, not only sequence control and simple numerical operation control, which are alternatives to relay contact logic, but also high-speed matrix operation to perform multivariable control, fuzzy control to handle ambiguity, and learning Various types of control such as neural network application control with capability have come to be used in combination. However, at present, such a control system is constructed by appropriately combining controllers each having a dedicated function. As a result, if advanced control is to be performed, it is necessary to place various types of controllers in the distributed system, which increases complexity and costs associated with design, programming, operation, and maintenance. There was a problem to do.

  In addition, a so-called multiprocessor configuration controller in which one controller is realized by a plurality of processors is also realized. For example, a controller is realized by a plurality of processors such as a network control processor that performs transmission processing, a numerical operation processor, and a high-speed sequence processor. However, in the conventional method, it is necessary to prepare a plurality of types of processors corresponding to various control contents and change the combination according to the control target. That is, since the types, points, and control contents of various sensors and actuators to be controlled are different, each processor and process input / output card can be added and replaced by plug-in units. However, when this controller is made into one board or LSI, a very difficult situation occurs. In other words, boards and LSIs with different functions for each control target will be created, which will be a major obstacle in terms of development period and development cost, and maintenance parts and maintenance management corresponding to all types will be required in terms of maintenance. , Leading to increased maintenance costs. In particular, one of the merits of using LSIs is to reduce the price by mass production. Thus, the development of many types of LSIs individually cannot take full advantage of the LSIs.

  In addition, with respect to controller programming, the user has conventionally written programs for each controller. In general, the program becomes complicated when trying to obtain better control performance. Also, with conventional programs, it has been very difficult to respond flexibly to changes over time, environmental changes, and user preferences. Therefore, there is an approach of improving controllability while gradually learning using a neural network or the like. However, in the conventional learning approach, a great deal of learning and experience must be gained before obtaining the desired output, and in the initial stage of learning, only what is far from the desired control output can be obtained. Always. On the other hand, it is also true that a value close to the desired control output must be obtained from the initial stage of control. In addition, when the knowledge possessed by the user is excellent, a method of maximizing the use of the knowledge is desired. However, it is difficult to determine whether the learning result by neuro or the like or the knowledge of the user is superior.

  Furthermore, with regard to the evaluation of control performance, for example, as in the case of automobiles, there are often a plurality of standards such as riding comfort, speed, and temperature. In addition, the value standard varies from person to person, and even the same person varies from time to time. In order to flexibly cope with such a situation, it is necessary that the user can change the value criterion calculation method during operation.

  For a network, if the control target is in a steady state, the amount of communication information does not increase or decrease, but the amount of communication information increases in a transient state, particularly when an abnormality occurs. For example, even with a blackboard architecture, which is a diagnostic method of a conventional distributed control system, there is a risk that a large number of failure information is transmitted from the individual controllers to the communication network when a common mode failure occurs, causing a network communication bottleneck.

Furthermore, with respect to improving the operating rate and reliability of the distributed control system, when one controller fails (down), another controller substitutes (loads) the load. For example, as shown in Patent Document 1 and Patent Document 2, a method is known in which a controller to be backed up for a certain controller down is determined in advance. Furthermore, as shown in Patent Document 3 and Patent Document 4, in computer systems, a method is known in which the load of a down computer is divided and backed up by a plurality of computers according to the load status of each computer. However, the former method had to prepare a controller dedicated to backup. Further, since the latter method centrally manages load distribution, there is a possibility that the entire computer system may stop when the computer for centralized management goes down.
Japanese Patent Laid-Open No. 62-177634 JP 63-118860 JP-A-2-224169 JP-A-3-296851

  One problem to be solved by the present invention is to realize a control system that can minimize the number of devices to be controlled controlled by a single controller and can distribute risk.

  Furthermore, another problem to be solved by the present invention can be applied to a dedicated installation space for the controller and a distributed installation type control system that can eliminate or minimize the installation of the connection cable between the input / output of the controller and the plant. It is to realize a controller.

  Furthermore, another problem to be solved by the present invention is to provide a versatile controller that can handle various control objects and control methods with as few types as possible.

  Still another object of the present invention is to provide a small and low-cost controller.

  Furthermore, another problem to be solved by the present invention is to provide a scalable controller that can be configured with the same architecture from a small-scale controller to a large-scale controller.

  Still another object of the present invention is to provide a controller that can be programmed with functions according to the purpose after the hardware is completed. The function program mentioned here is to embed dedicated processing functions such as a numerical operation function, a fuzzy inference function, a neural network processing function, and a sequence operation function in hardware in the controller.

  Still another object of the present invention is to provide a controller capable of self-repair with respect to a partial failure.

  Still another object of the present invention is to provide a control system with simple programming.

  Furthermore, another problem to be solved by the present invention is that a distributed control system that reduces failure information transmitted from each controller to the communication network when a common mode failure occurs and is unlikely to cause a system down due to a network communication bottleneck. Is to provide.

  Furthermore, another problem to be solved by the present invention is to autonomously divide the load of a controller that has been down by a normally operating controller without providing a centralized controller and a standby controller. It is to realize a distributed control system that can be backed up. In particular, even in the case of multiple downs of controllers, the normally operating controllers cooperate to effectively utilize the surplus performance and perform backup to the limit of the total performance of the distributed control system.

  In order to solve the above problems, in the present invention, both the internal configuration and the external structure of the controller are extensible, and the basic unit is made into an LSI so that a small controller can be realized. Therefore, it can be used as a distributed installation type or a centralized installation type. Also, a risk distribution system can be realized by arranging this controller in units of devices to be controlled.

  Furthermore, in order to realize a versatile controller, a processor that executes a parallel operation function for high-speed operation of a neuro, fuzzy, matrix, etc. as well as a numerical operation function of one controller, and a sequence control operation at high speed A processor to be executed and a plurality of processors such as a processor to execute a communication function with a network are configured so that each function can be executed in parallel. In addition, a method for realizing a chip capable of function programming the input / output and the processor is also provided.

  In addition, there is provided means for allowing another processor to substitute its function even if one processor in the same controller goes down.

  A means or method for calculating a neural network and a conventional model provided by a user is provided in the control calculation unit, and the control output is generated by weighting and adding both. In the state where learning is not advanced, the user's assigned model output is set to 100% or a value close thereto, and then updated by learning. Also, the weighting value for the output value from the neuro or other means is also set. It was decided to conduct learning using a neural network.

  As for the evaluation, the evaluation value of the state is displayed to the user, and the user has a means for correcting it. Further, the user defines a new evaluation standard, and at the least after processing a plurality of evaluation values. The value is obtained and the output calculation method is updated using this value.

  Furthermore, as a means to reduce the network load at the time of fault diagnosis, redundant information is provided by storing network transmission information in a man-machine device, editing and processing a network monitor, and an input / output information filter attached to each controller. I didn't get on the network.

  Furthermore, the means for autonomously dividing and backing up the load of the controller that has gone down shows the task that each controller is executing, the execution allocation table that shows the load status, and the load when each task is executed Backup request means for requesting backup based on the task load table and an acceptance order table indicating which controller has sufficient capacity depending on the load status of each controller and backup can be easily performed, and the table determines whether backup can be accepted. It comprises backup accepting means for answering whether or not it has been accepted and instructing execution of the accepted task.

  In addition, in order to improve the fault tolerance and reliability of one controller itself, each controller is composed of multiple processors, and the above execution allocation table further backs up the load status of each processor and which processor has spare capacity The internal backup means for determining the processor that backs up the load of the failed processor according to the execution assignment table and the task load table is provided.

(Function)
By realizing a controller that can execute one type of various control functions in parallel, a distributed control system having a flexible system configuration capability can be constructed. In other words, multiple controllers with the same hardware structure can be installed, so that even if one controller fails, it can be easily backed up by another controller, and the controller can be installed in places where quick maintenance is difficult. Distributed installation.

  As for programming, the user may program a relatively simple model as the assigned model. In the initial stage of learning, the operation is performed according to the given model, and the weight value for the output of the neural network can be increased as the learning progresses and the output value of the learning model by the neural network improves. Furthermore, by providing a state evaluation unit and evaluating the output data by time differentiation of the output, the weight value can be gradually changed by learning without the user being conscious. In addition, the weight value is obtained from the input data by a neural network, and further, the neural network is trained so that the output of the given model is good and the output of the learning model is good when the output of the learning model is better. In some cases, the weighting method can be changed so that the weight is increased.

  In addition, the evaluation value display means and the correction means can be easily corrected when the evaluation value is misaligned between the evaluation value and the user's feeling. In addition, the user sets a new evaluation standard, and is further as close as possible to the user's evaluation method. Then, the items that the user feels the most unsuitable are extracted by taking the minimum value by directly or converting some of the evaluation criteria thus created, and using this evaluation criteria, the control output calculation method By updating, it becomes possible to perform harmonious control in view of a plurality of evaluation criteria.

  Regarding the means to reduce the network load at the time of failure diagnosis, each controller sends abnormality information to the input / output filter when a failure occurs, and the input / output filter has already transmitted the abnormality information including the transmitted abnormality information to the network. By referring to the history information stored in each controller, and if the abnormality information including the transmitted failure information has not already been transmitted to the network, by transmitting the abnormality information to the network, It is possible to prevent redundant abnormality information from being transmitted to the network.

  In addition, for autonomous backup, the controller to search for which controller backup request means should be backed up and the controller suitable for backup by using the execution allocation table, task load table, and reception order table provided in each controller. It is possible to notify the reception means. In addition, the backup accepting means of the controller requested to back up determines whether or not the backup target task in this notification can be executed based on its own load of its own execution allocation table, and selectively performs the backup target task. Accept. By broadcasting the result of this selection as an acceptance message, the requester and other controllers can reflect changes in the load status of the controller that has performed the backup in the execution allocation table and the acceptance order table. Furthermore, it is possible to know the backup target task that was not accepted by the requesting controller, and again the acceptance order table (At this time, the controller that performed the backup first will not be at the top of the acceptance order table because the load factor increases. It is possible to request a new controller for unaccepted items.

  In this way, according to the present invention, each controller always keeps track of the execution status of the system accurately, and the controller requested to back up can reject the request, so the task to be backed up is divided / distributed autonomously. Can be processed. Furthermore, even when one of the multiple processors included in one controller fails, the internal backup means selects a processor with a low load from the execution allocation table and determines whether or not the load of the failed processor can be backed up by that processor. A backup is performed so that the processor does not overload, and if there is a remaining load, another processor is selected and backed up in the same manner. As described above, the internal backup means divides the load of the failed processor so that it does not exceed the load of each processor so that it falls within the load limit of each processor, and backs up one after another by a plurality of processors.

  A single controller with a numerical operation function, a processor that executes a parallel operation function for high-speed operation of neuro, fuzzy, matrix, etc., a processor that executes a sequence control operation at a high speed, and a communication function with a network A controller that can be applied to a wide range of fields can be realized by configuring a plurality of processors such as a processor to be executed and enabling each function to be executed in parallel. By connecting this controller to a network work, a distributed control system applicable to a wide range of fields can be realized.

  In addition, a method for realizing a chip capable of function programming the input / output and the processor is also provided. As a result, a wide variety of control targets can be handled with a small number of controllers, and a system excellent in maintainability can be configured.

  By configuring each processor with a processor element of a smaller unit, flexibility is improved, LSI implementation is facilitated, and the size of the controller can be reduced. Therefore, the controller body can be reduced in size, and a controller that can be installed in a distributed manner can be realized. Further, by providing a spare area for the spare processor and the non-volatile memory, the controller itself can self-repair for a partial failure.

  Further, by adopting an external structure with a bus connector that allows easy expansion of the bus, it is possible to cope with a wide range of control objects from a small scale to a large scale.

  In addition, a user-written program and a plurality of outputs obtained by a plurality of output generation means such as a neural network can be adaptively combined with the learning situation and changes over time, etc., thereby enabling better control. The user's favorite control can be performed by the operation.

  Furthermore, according to the present invention, it is possible to prevent occurrence of a communication bottleneck due to a large amount of abnormality information occurring in the network when a common mode failure occurs in the distributed control system. In addition, it is possible to identify a failure location in the distributed control system.

  Furthermore, according to the present invention, it is possible to distribute and back up the load to the operating controllers autonomously even when the controllers of the distributed control system are down. Furthermore, since the controller of the distributed control system is configured by a plurality of processors according to the present invention, it is possible to distribute and back up the load to the active processors autonomously even when multiple processors in the same controller are down. . For this reason, it is possible to improve reliability and fault tolerance.

  Embodiments of the present invention will be described below in detail with reference to the drawings.

  FIG. 1 shows a plant control system according to an embodiment of the present invention. The plant 100 to be controlled includes analog sensors 111, 115, and 119 such as flow meters, analog actuators 112, 116, and 120 such as control valves, digital sensors 113, 117, and 121 such as limit switches, and digital sensors such as solenoid valves. It consists of actuators 114, 118, and 122. In this example, the sensor 111 and the actuator 112 constitute a set, and the sensor 113 and the actuator 114 constitute a set, each constituting a control target device. In this figure, only one sensor and one actuator are shown for each control target device, but there may be a plurality of these devices. The controllers 1, 2, 3, 4, 5, and 6 are arranged corresponding to each control target device, and they are connected by a network 1000.

  The man-machine device 1200 is a device that monitors the operation of the plant and in some cases issues a manual operation command to each controller.

  Next, a steel rolling control system that is one specific example of one embodiment of the present invention will be described. For reference, a conventional steel rolling control system will be described with reference to FIG. The payoff reels 151 and 152 are coils of a material to be rolled, and the material to be rolled 180 is rolled by rolling mills 155, 156, 157, and 158 via an entry side processing line 153 and a looper 154 to become a final product 181. 159 is wound up. The reels, rolling mills and the like are driven by motors 140, 141, 142, 143, 144, 145, and 146. The drive devices 130, 131, 132, 133, 134, 135, 136 corresponding to the respective motors are power circuits that drive the respective motors. Conventionally, the drive devices 130, 131, 132, 133, 134, 135, 136 are composed of a power converter 190 and a dedicated high-speed controller 195 that controls the power converter 190. Although only the inside of the drive device 130 is illustrated in FIG. 2, the internal configuration of the drive devices 131, 132, 133, 134, 135, 136 is the same. On the other hand, the controllers 1500, 1501, 1502, and 1503 are configured to calculate the speed command of each motor from the plate thickness target value, the entry side plate thickness, the tension between the stands, and the like and output the command value to each drive device.

  The operation monitoring of this control system is performed by man-machine devices 1200 and 1201. Each controller and man-machine device are connected by a network 1000.

  FIG. 3 shows a steel rolling control system to which the present invention is applied. In this embodiment, controllers 11, 12, 13, 14, 15, 16, and 17 are assigned to the motor drive devices 161, 162, 163, 164, 165, 166, and 167 on a one-to-one basis. Moreover, each of the motor drive devices 161, 162, 163, 164, 165, 166, and 167 is composed of only the power converter 190, and there is no dedicated controller as in the prior art. As will be described later, the controller of the present invention has a multiprocessor configuration, and the conventional power converter control function is assigned to one processor in the controller.

  Although not shown, the control of the gap between rolls of the rolling mills 155, 156, 157, 158 is usually controlled by a hydraulic pressure reducing device. This hydraulic reduction device must also be controlled at a high speed of several milliseconds, and conventionally a dedicated controller has been specially arranged. However, according to the present invention, just like the motor control, one processor in the controller for calculating the reduction command may be assigned to the control. By adopting such a configuration, as described later, a very reliable and high performance control system can be realized.

  4 and 5 show the control of an automobile according to another embodiment of the present invention. FIG. 4 explains the control items of a general automobile. FIG. 5 shows the configuration of a control system when the present invention is applied to the control of an automobile.

  The controller 21 controls the engine 21a. The controller 21 detects the amount of air flowing into the cylinder, the rotational speed and rotational angle of the engine, the angle at which the accelerator pedal is depressed, the temperature of the engine cooling water, and the temperature of the exhaust purification catalyst. In accordance with these, the fuel injection amount is manipulated so that the ratio of fuel to air in the cylinder becomes the stoichiometric air-fuel ratio. Then, the ignition timing is manipulated according to the state quantity. These operations increase engine efficiency and increase output. At the same time, it reduces harmful substances in the exhaust. Further, when the temperature of the engine cooling water and the temperature of the exhaust purification catalyst are lower than the proper temperature, the controller 21 slightly advances the ignition timing in order to quickly warm them. When the controller 28 notifies the lighting of the headlamp and the operation of the cooling device via the network 1000, the controller 21 slightly opens the throttle to increase the engine output in order to prevent engine stop and vehicle speed fluctuation. When the vehicle speed notified by the controller 22 via the network 1000 exceeds a specific value, the controller 21 reduces the fuel injection amount so that the vehicle speed does not greatly exceed the specific value. When the controller 22 notifies via the network 1000 that a shift is in progress, the controller 21 adjusts the engine output so that the acceleration changes smoothly before and after the shift. When the accelerator pedal depression angle suddenly increases, the controller 21 determines that the driving vehicle requires rapid acceleration. And this controller 21 requests | requires the stop of a cooling device with respect to the controller 28 via the network 1000, in order to use the output of the engine currently consumed with the cooling device for a vehicle acceleration. At the same time, the controller 22 is requested to shift down.

  The controller 22 controls the transmission 22a. The controller 22 detects the vehicle speed and shifts to a gear ratio corresponding to the detected vehicle speed. At this time, the vehicle speed serving as a reference for shifting is changed according to the throttle opening degree notified by the controller 21 via the network 1000, the rotational speed of the engine, and the vehicle body posture notified by the controller 23. When the throttle opening is small and the engine speed is high, the output loss due to the intake resistance of the engine increases, so the engine speed is lowered by shifting up at a low speed. When the vehicle body posture is tilted backward, it is determined that the vehicle is climbing a slope, the reference vehicle speed for upshifting is increased, and the climbing force is maintained by using a low-speed gear.

  The controller 23 controls the suspension 23a. This controller 23 detects the displacement of the suspension and the posture of the vehicle body, receives the vehicle speed from the controller 22 and the steering angle from the controller 25 via the network 1000, and controls the air pressure in the air spring of the suspension according to these. Make the desired body posture. The controller 23 notifies the other vehicle controller of the vehicle body posture via the network 1000.

  The controller 24 controls the brake 24a. The controller 24 detects the rotational speed of the tire, receives the vehicle speed from the controller 22 via the network 1000, and the steering angle from the controller 25, determines the slip ratio of the tire with respect to the ground in accordance with these, and this value is a predetermined value. The braking force is determined to be as follows. Furthermore, the vehicle turns smoothly with weak braking applied to the inner ring during turning.

  The controller 25 controls the power steering 25a. The controller 25 detects the twist angle of the steering shaft and adjusts the assist torque of the power steering so that the angle becomes small. Further, the controller 25 detects the steering angle and notifies other controllers via the network 1000.

  The controller 26 diagnoses the failure. The controller 26 detects the failure or deterioration of the other controller or the control target device by comparing the state quantity and the operation quantity notified from the other controller via the network 1000 with its own simulation result. When a failure or deterioration is detected, a failure diagnosis result is notified to the controller 28.

  The controller 27 is a drive recorder, and stores the history of vehicle operation notified via the network 1000 in a storage device that is resistant to shock and heat.

  The controller 28 controls man-machine interfaces such as a switch 28a, a meter 28b, and a display 28c. When the driver operates the switch 28a, the controller 28 activates or stops the corresponding device according to the on / off of the switch 28a. Further, the state quantity such as the vehicle speed and the engine speed notified via the network 1000 and the result of the failure diagnosis are displayed on the meter 28b or the display 28c. Various devices are turned on / off in response to a request or request from another controller via the network 1000.

  In this way, each controller notifies each other of the detected state quantity and control output or operation request via the network 1000, and each controller controls the device in charge according to the notified state quantity, control output and operation request. To do.

  As described above, one feature of the present invention resides in that a plurality of controllers are distributed and arranged corresponding to each control target device.

  FIG. 6 shows a system configuration example when the present invention is applied to a hierarchical system. When the plant is composed of different control target device groups 100, 101, 102, or when the control device groups 100, 101, 102 are distributed over a wide area, the network is connected to the network 1000, Controllers 1, 2, 3, 4, 5, and 6 are arranged under each network and divided into 1001 and 1002. The networks 1000, 1001, and 1002 are connected to the upper network 1500 via the overall controllers 1300, 1301, and 1302, respectively. The general man machine 1600 monitors the operation of this control system.

  7 and 8 show the internal configuration of the controller described so far. The controller 1 includes a global memory (GM) 52, arithmetic processors (PR1, PR2, PR3) 54, 56, 58 input / output processing unit (I / O) 53, a network control processor (NCP) 40, a network connector (NetworkConnector) 41, It is composed of connectors (BusConnector) 60, 61, 62, 63 for scale expansion and a connector (I / O Connector) 64 for connection to the control target device. The arithmetic processors (PR1, PR2, PR3) 54, 56, 58 have local memories (LM1, LM2, LM3) 55, 57, 59, respectively.

  The NCP 40 reads the contents of the GM 52, LM 55, 57, 59 and the I / O 53 via the bus 70 and transmits them to another controller or man-machine device (1200 in FIG. 1), and conversely, another controller or man-machine device. It has a function of writing data transmitted from 2000 to GM52, LM55, 57, 59 and I / O53. The bus 72 is used by the processors 54, 56, and 58 to access the GM 52 and the I / O 53. The bus 71 is a serial data bus for transmission. By adopting such a configuration, it is possible to secure the expandability of the controller, and even if one processor fails, it can be replaced by another processor (described later) and all the processors in one controller have failed. In addition, a system that can be replaced by another controller (described later) can be constructed.

  FIG. 8 shows the internal configuration of the processor (PR1) 54 in FIG. In FIG. 7, each processor has the same configuration, and the configuration will be described by taking the processor (PR1) as an example. The processor (PR1) 54 is a general-purpose engine (GE) 6811 for executing a task, a neural engine (NE) 6812 for accelerating a neuro operation included in the task, and a sequence control included in the task. A sequence engine (SE) 6813 for accelerating the computation of the bus, a bus interface (BIF) 6817 for coupling the bus 70 and the bus 6819 in the processor when the memory to be accessed is the global memory (GM) 52, and a local memory (LM) 55 and a direct memory access control (DMAC) 6818 that performs high-speed transfer between the global memory (GM) 52, a free run timer (FRT) 6815 that is a clock for scheduling, and a failure of each component is detected To stop the processor and The processor including a failure control circuit 6820 to notify through the bus 72. Further, each component is connected by a bus 6819.

  FIG. 9 shows the internal configuration of another embodiment of the controller described so far. 7 differs from FIG. 7 in that each processor 84, 87, 90, 93 converts serial data into parallel data so that the functions of the NCP 40 in FIG. 7 can be executed by any of the processors 84, 87, 90, 93. This is the addition of run adapters (LA) 86, 89, 92, and 95 for executing the reverse operation and encoding / decoding. As a result, transmission function (NCP) substitution processing can be performed in the same manner as processor substitution processing.

  FIG. 10 shows the internal configuration of the processor (PR1) 84 in FIG. 8 differs from FIG. 8 in that a connection interface 6902 for a run adapter (LA) 86 and a bus 6819 is provided.

  FIG. 11 shows the internal configuration of yet another embodiment. 9 is that cache memories (CM) 301, 302, 303, and 304 are used in place of the local memories 85, 88, 91, and 94 in FIG. Cache memory controllers (CMC) 401, 402, 403, and 404 transfer data between the cache memory (CM) 301, 302, 303, and 304 and the global memory 400.

  FIG. 12 shows the internal configuration of the processor (PR1) 84 in FIG. 10 is that the direct memory access control (DMAC) 6818 in FIG. 10 is not required in FIG. This is because the cache memory controller (CMC) 401 performs data transfer between the cache memory (CM) 301 and the global memory 400.

  FIG. 13 shows the internal configuration of yet another embodiment. The difference from FIG. 11 is that the connection between the run adapters 86, 89, 92, 95, the network connector 41, and the processors 84, 87, 90, 93 is made programmable by programmable switch arrays (PSW1, PSW2) 8101, 8102. As a result, the transmission function can be executed by any of the processors 84, 87, 90, and 93, and a run adapter (LA) 86 that executes serial data in parallel or vice versa and encoding / decoding is performed. , 89, 92, and 95, the transmission function can be replaced without switching the processor by switching the run adapter (in the configuration of FIG. 11, it is necessary to switch the processor even if the run adapter is faulty. ). The internal configuration of the processor in FIG. 13 may be the same as that shown in FIG.

  FIG. 14 shows a configuration example of a programmable switch array. A MOS transistor Tij is provided at the intersection of the inputs / outputs Xi and Yj to the switch array, and a nonvolatile memory cell Mij is connected to the gate of the MOS transistor Tij. That is, when the output of the memory cell Mij is “1”, the MOS transistor Tij is turned on, and Xi and Yj are connected. Conversely, when the output of Mij is “0”, Tij is OFF and Xi and Yj are separated. Further, address lines A1, A2, A3 and data lines D1, D2, D3 are connected to the memory cell Mij, and data is written through these.

  FIG. 15 shows an internal circuit example of the memory cell Mij. In this circuit, a flash memory is used as a nonvolatile memory element. In the normal operation state, the rewrite mode signal is “LOW”, NMOS: N1 is OFF, and PMOS: P1 is ON. Further, the potential of the address line is equal to the power supply voltage, for example. Therefore, the potential of the node A is “LOW” when the memory element is in the erased state (threshold voltage is low), and the output of the inverter I2 is also “0”. That is, the MOS transistor Tij connected to this cell is turned off. Conversely, when the memory element is in a write state (threshold voltage is high), the potential of the node A is “HIGH”, and the output of the inverter I2 is “1”, and the switch MOS transistor Tij is turned on. To write to the memory cell, the write mode signal is set to “HIGH”, NMOS: N1 is turned on, and PMOS: P1 is turned off. In this state, by applying a high voltage to the address line and the data line, the memory element M1 enters a write state. The memory element is erased by setting the address line to “LOW” and applying a high voltage to the source of the memory element.

  FIG. 16 shows a configuration for providing a spare area in the programmable switch array to enable relief against a partial failure. This example is obtained by adding failure relief elements: Ts1 to Ts3, T1s to T3s, Ty1 to Ty3, Ms1 to Ms3, and M1s to M3s to the switch array shown in FIG. In a state where there is no normal failure, Ts1 to Ts3 and T1s to T3s are OFF and Ty1 to Ty3 are ON, and the same operation as the circuit of FIG. 14 is performed. Next, a remedy method when a failure is detected will be described below. A case where the memory cell M11 fails will be described. First, the contents of M11 to M13 are moved to Ms1 to Ms3. Next, M1s is set to “1”, T1s is turned ON, and Ty1 is turned OFF. As a result, the failed part is replaced with a spare circuit, and the same operation as before the failure is possible.

  FIG. 17 shows an example of the internal configuration of the general-purpose engine in FIG. 8, FIG. 10, and FIG. This engine includes a microprogram memory 8202, a read circuit 8203, a microinstruction register 8204, a decoder 8205, a register, an arithmetic unit 8206, a multiplexer 8208, and an address decoder 8207. Initially, the address decoder 8207 is cleared and the instruction at the zero address in the microprogram memory 8202 is interpreted and executed by the decoder 8205. The microinstruction indicates the address of the instruction to be executed next (8207). In this way, the micro instructions written in the micro program memory 8202 are sequentially executed.

  The microprogram memory 8202 is composed of, for example, a nonvolatile memory such as a flash memory, and the function of the processor can be changed to one intended for the purpose by rewriting the microprogram. For this rewriting, the microprogram memory 8202 has a built-in dedicated rewriting circuit 8201, and the address and data supplied from the rewriting address bus 8301 and data bus 8300 by setting the rewriting mode by the rewriting mode signal 8302. Rewriting is performed according to.

  FIG. 18 shows an example in which each processor is constituted by a combination of a plurality of processor elements (PE) as another embodiment. Each processor is configured by combining a necessary number of processor elements according to the purpose of each processor. In this way, the entire LSI can be configured with the same processor element, which can be easily integrated into an LSI and can be configured with less waste.

  Next, the input / output unit will be described in detail.

  As described above, the types and points of sensors and actuators connected to each controller vary depending on the control target. Therefore, conventionally, it was necessary to select an input / output device corresponding to them from the repertoire and connect it to the controller. On the other hand, in the present invention, since the purpose is to construct a control system using as few kinds of hardware as possible, the following input / output configuration is adopted.

  FIG. 19 shows the internal configuration of the I / O 83 in FIG. The I / O 83 includes an analog output composed of a bus interface 830, a D / A converter 832 and an OP amplifier 833, an analog input composed of an OP amplifier 835 and an A / D converter 834, a digital output composed of a register 836 and a power circuit 837, and power. It consists of a digital switch consisting of circuit 838 and a power switch array 840 that determines the coupling between these and the I / O connector 64.

  The power switch array 840 is programmed from the interface circuit 830 through the signal line 850. The configuration of the power switch array 840 is the same as that shown in FIG. 16, but it is necessary to increase the physical capacity in order to handle the power.

  FIG. 20 shows a configuration diagram in which the I / O 83 is realized by a one-chip semiconductor. The upper semiconductor 980 includes a power circuit unit 902, a power switch array unit 901, and a connection terminal 900 for a process. The lower semiconductor 950 includes an OP amplifier unit 951, a D / A conversion unit 952, and an A / A conversion unit. A D conversion unit 953, a register unit 954, a bus interface 955, and a connection terminal 960 with the bus interface (FIG. 21 illustrates the lower semiconductor 950). In addition, wiring between the upper semiconductor 980 and the lower semiconductor 950 is performed by the wiring layer 970.

  22 and 23 show a configuration diagram in which the controller 1 'in FIG. 9 is realized by a one-chip semiconductor. The semiconductor is largely composed of two layers, and the upper semiconductor 980 has the same configuration as that of FIG. 20, but the lower semiconductor 950 is a memory other than the OP amplifier unit 951, the D / A conversion unit 952, the A / D conversion unit 953, and the register unit 954. A group 956 and a processor group 957 are included (FIG. 23 illustrates the lower semiconductor 950). In addition, wiring between the upper semiconductor 980 and the lower semiconductor 950 is performed by the wiring layer 970.

  The internal configuration of the controller has been described using the embodiment. However, the scope of the present invention is not limited to the scope of the embodiment, and various modifications can be made. For example, as the non-volatile memory for the function program, an electrically rewritable EEPROM or ferroelectric RAM other than the flash memory, or an SRAM backed up by a battery may be used.

  Next, FIG. 24 shows the appearance of the controller of the present invention. An I / O connector 64 is mounted on the front surface of the controller, and scale expansion connectors 60, 61, 62, 63 are mounted on the left and right side surfaces and the upper and lower surfaces. A network connector 1701 and a power connector 1702 are mounted on the back surface 1700. The external dimensions are about 20 cm in height, about 10 cm in depth, and about 3 cm in width, and can be connected to the input and output and are sufficient for distributed installation. This dimension is for reference to show how much the size can be reduced by the present invention, and the present invention is not limited to this dimension.

  FIG. 25 shows two controllers connected using scale expansion connectors 60 and 61.

  FIG. 26 is a diagram in which two controllers are connected using scale expansion connectors 62 and 63.

  FIG. 27 shows a combination of four controllers using scale expansion connectors 60, 61, 62 and 63.

  Thus, the controller scale can be easily expanded by having the bus configuration and the external structure of the present embodiment.

  Next, the control calculation method used in the present invention will be described.

FIG. 28 shows a basic configuration diagram of a control calculation unit that performs control calculation based on input data from a sensor or the like. In the present invention, the input data 2001 is inputted to a plurality of output generation means, here, three means of a neural network 2101, fuzzy inference means 2102 and PID control means 2103. Then, the weighting unit 2021 weights the output values of the output generation means with the corresponding weight values K ₁ , K ₂ , and K ₃ , adds the output values weighted by the output data synthesis unit 2022, and outputs the output data 2002. Get. At this time, if the weight values K ₁ , K ₂ , and K ₃ are added to be set to 1, the output data synthesis unit 2022 may simply add the weighted outputs. Here, the three means of the neural network 2101, the fuzzy reasoning means 2102, and the PID control means 2103 can be executed in parallel, so that they are executed by different processors (for example, the processors 54 and 56 in the controller of FIG. 7). , 58 is responsible for three types of calculations), so that control calculations can be executed without reducing the processing speed.

  FIG. 29 shows an overall schematic diagram of the embodiment. Here, a control method that includes an output calculation unit 2012 and an output evaluation unit 2015, and in which the output calculation unit 2012 and the evaluation unit 2015 have a learning model and a grant model, respectively, and adaptively coordinate both of them will be described. Input data 2300 obtained by performing input processing on the data 2001 from the sensor or the like 2010 by the input processing unit 2011 as necessary is input to the output calculation unit 2012 and the evaluation unit 2015. In the output calculation unit 2012, the input data 2300 is received, the output data 2301 is calculated using parameters and the like in the input data, and the output processing unit 2013 performs necessary output processing as necessary, and then the value is obtained. 2002 is output to the actuator 2014. Here, the parameters and the like include a weight value for coupling between neurons in the neural network that is a learning model, a parameter in the grant model, and a parameter for weighting the learning model and the grant model. On the other hand, the evaluation unit 2015 also evaluates the current state using the input data 2300 and internal parameters, and outputs an output evaluation signal 2302 from the result. Then, the output calculation unit 2012 uses the output evaluation signal 2302 to learn internal parameters and the like so that this value becomes large. On the other hand, with respect to the parameters in the evaluation unit 2015, for example, a state evaluation signal 2303 is displayed on the man-machine device 1200, and when the user feels inappropriate by looking at the state evaluation signal 2303, a correction value is used using a pointing device 2017 such as a touch panel Enter. This is input to the evaluation unit 2015 as an external evaluation signal 2304. At this time, the external evaluation valid signal 2305 is turned on and the parameters in the evaluation unit 2015 are updated so that evaluation suitable for various situations can be performed. I will let you.

  The configuration of the output calculation unit 2012 is shown in FIG. In the learning of the output calculation unit 2012, since there is no direct teacher signal like the external evaluation signal 2304 in the case of the evaluation unit 2015, a random number component is added to each parameter and the random number component is calculated based on the evaluation value at that time. Evaluate and make corrections. Therefore, the output calculation method is as follows. First, the learning model calculation unit 2401 calculates an output using the learning model parameters obtained from the input data 2300 and the learning model parameter holding unit 2421, and the input data 2300 and the grant model according to the grant model given in advance by the user. An output of the assigned model calculation unit 2402 is obtained by using, as a parameter, a parameter obtained by adding a minute random number by the random number adding unit 2412 to the assigned model parameter obtained from the parameter holding unit 2411. The weighting unit 2403 weights and adds the respective output values to obtain output data 2301. However, the output from the learning model calculation unit 2401 is weighted by adding a random number by the random number addition unit 2422. Further, the weight value used in the weighting unit 2403 is also weighted by actually using the weight value held in the weight value holding unit 2431 with a random number added by the random number adding unit 2432. First, regarding the weight value of the weighting unit 2403, the weight value update amount calculation unit 2434 multiplies the random number 2433 added by the random number addition unit 2432 and the output evaluation signal 2302 obtained from the evaluation unit 2015, for example, and the weight value holding unit The value is passed to 2431 to be a new weight value in addition to the original weight value. On the other hand, for the parameters in the learning model calculation unit 2401, the output error calculation unit 2424 multiplies the random number 2423 added by the random number addition unit 2422 and the output evaluation signal 2302 from the evaluation unit 2015, for example, to calculate the learning model. The learning model calculation unit 2401 calculates an update amount for a parameter such as a weight value of an internal neural network according to a learning algorithm such as backpropagation based on the value, and calculates a new value as a learning model. Write to the parameter holding unit 2421. In addition, the assignment model calculation unit 2402 also multiplies the random number 2413 added by the random number addition unit 2412 and the output evaluation signal 2302 from the evaluation unit 2015 in the assignment model parameter update amount calculation unit 2414, for example, and assigns the value. The value is transferred to the model parameter holding unit 2411 and the new assigned model parameter value is written.

  On the other hand, FIG. 31 shows a configuration of the evaluation unit 2015. Here, first, an output is obtained from the learning model calculation unit 2501 using learning model parameters such as a weight value of the combination of the neural network obtained from the input data 2300 and the learning model parameter holding unit 2521. In parallel with this, the assigned model calculation unit 2502 calculates an output using the input model parameters obtained from the input data 2300 and the assigned model parameter holding unit 2511 according to a model given in advance by the user. The weighting unit 2503 weights and adds the respective output values based on the weight values held in the weight value holding unit 2531, and the time differentiation calculation unit 2505 performs time differentiation on the result. An output evaluation signal 2302 is generated. The learning in the evaluation unit 2015 is performed based on a signal from the external evaluation signal 2304 when the external evaluation valid signal 2305 is on. For example, the respective outputs of the learning model calculation unit 2501 and the assigned model calculation unit 2502 are compared, the weighting parameter closer to the external evaluation signal 2304 is increased, and the other parameter is decreased. The learning model calculation unit 2501 performs learning by giving the external evaluation signal 2304 as a teacher signal. On the other hand, the assigned model calculation unit 2502 obtains another output value by giving a small random number to the parameter in addition to the normal output value, and compares the two to add the random number, which is closer to the external evaluation signal 2304. For example, if it is better to add the actual number multiplied by the added random number and the learning constant and not add the random number, learning by subtracting the added random number and the learning constant from the parameter It can be carried out. Further, the grant model may not have a learning function, and the evaluation unit 2015 may have only the grant model calculation unit and no learning model calculation unit. In addition, when both the learning model calculation unit 2501 and the grant model calculation unit 2502 are provided, the weights of the outputs of both in the initial state are set to 1 on the grant model side and 0 on the learning model side, so that the learning is started. Can be prevented from affecting the output of the learning model.

  Next, an example in the case of having a plurality of evaluation criteria is shown. An overall configuration diagram is shown in FIG. Here, it is assumed that there are a first evaluation unit 2601 and a second evaluation unit 2602 as a plurality of evaluation units. In the modification of the parameters in each evaluation unit, the state evaluation value 2603 of the first evaluation unit 2601 and the state evaluation value 2604 of the second evaluation unit 2602 are displayed on the man-machine device 1200, as in the case of one evaluation unit. Is corrected using a pointing device 2017 such as a touch panel or a mouse, and when it is corrected, 1 is set to the corresponding external evaluation valid signal 2605. Then, the correction value at that time is transferred as an external evaluation signal 2606 to each evaluation unit. Then, the corresponding evaluation unit may correct the internal parameters. Also, a plurality of output evaluation signals can be obtained. For example, it is conceivable that the minimum value of the plurality of output evaluation signals is selected and given to the output calculation unit 2012. Then, the parameters in the output calculation unit 2012 can be updated so as to improve the evaluation criteria that the user feels most inappropriate.

  Next, FIG. 33 shows a case where the weight value for weighting the output by a plurality of means and methods is changed according to the input data 2001. Here, the input data 2001 is input to the neural network 2701, and a random number component is added to the output that has been output by the random number adding unit 2702. Based on the value K, the weighting unit 2021 uses the neural network 2101 and the output generation unit 2102. The output data 2002 is generated by weighting the output and adding the data weighted by the output data synthesis unit 2022. On the other hand, the teacher signal generation unit 2703 multiplies the random number component and the output evaluation signal 2302 and adds the result to the output of the neural network 2701 and passes it to the neural network 2701 as a teacher signal for learning. However, at this time, before learning starts, the output of the neural network 2701 may be set to a value close to 0, and the output of the output generation means 2 (2102) may be the output data 2002.

  Embodiments relating to a method for reducing network communication load according to the present invention will be described in detail below with reference to the drawings. FIG. 34 shows a configuration of a distributed control system that is an object of the present invention, and a plurality of controllers (1, 2, 3,...) Are controlled by a network 1000. Control information and diagnostic information for the entire system are processed and displayed in the man-machine apparatus 1200. Each controller not only executes control, but also executes diagnostic processing. Therefore, a communication interface 4012 for transmitting diagnostic processing unit 4010, control execution unit 4011, control information and diagnostic information to other controllers via a network. Have

  In such a distributed control system, when a common mode failure occurs, a lot of abnormal information from each distributed control sensor is transmitted to the network, which may cause a communication failure.

  For example, consider a case where each controller has a constraint condition, the constraint is checked in the diagnosis processing unit, and if a constraint is not satisfied, a constraint equation that does not satisfy the constraint is transmitted to the network. In such a case, the abnormality diagnosis is to identify which of the constraint variables of the constraint equation that are not satisfied is the cause that does not satisfy the constraint.

FIG. 35 shows input variables, output variables, and constraint equations of each controller of a distributed control system including four controllers as a specific example for the following description. For example, assume that the controller 1 has X1 and X2 as input variables, X3 as an output variable, and C1: E (X3, X1 + X2, e1) as a constraint expression. Here, E is an error relational expression and represents that the difference between the absolute values of the first variable and the second variable is equal to or smaller than the third variable. In this example,
X1 + X2-e1 <X3 <X1 + X2 + e1
It is shown that.

Assume that the state quantities of the target plant are X1 = 1, X2 = 2, and X4 = 2. When the controller controls each of these state quantities, each of the constraints shown in FIG. 35 is checked, and if the constraints are not satisfied, information is transmitted to the network. At this time, if the controller 1 is operating normally, X3 = 3, which is a value of X3 that satisfies the constraint condition C1, is determined from the values of the input variables X1 and X2, and output. However, suppose that the controller 1 fails for some reason and outputs X3 = 13. At this time, the controller 2 outputs X5 = 15 from the constraint condition C2 and the inputs X3 and X4 and X6 = 13 from the constraint condition C3 and the input X3, but the constraint condition C4 is not satisfied because the constraint condition C4 is not satisfied. An anomaly that is not satisfied is sent. In the controller 3, the output X7 = 195 from the inputs X3 and X5 and the constraint condition C5. However, since the constraint condition C6 is not satisfied, the controller 3 transmits an abnormality that the constraint condition C6 is not satisfied. . In the controller 4, X9 = 15 is output from the input variables X3, X5, and X6 and the constraint condition C7, and X8 = 26 is output from the constraint condition C8, but this does not satisfy the constraint condition C9. Is transmitted abnormality information that the constraint condition C9 is not satisfied.
As described above, in a distributed control system, since one controller has failed, there is a concern that abnormality information is output from many other controllers, a communication bottleneck occurs, and diagnosis is hindered.

  In order to solve such a problem, in the present invention, a method of filtering information inputted / outputted from each controller to the network is adopted. In addition, as data to be transmitted when an abnormality occurs, two data frames are prepared, one sent from each controller to the man-machine device for performing filtering and the other sent sequentially to each controller via the network. In accordance with this, if two types of networks connecting each controller and a man-machine device are prepared in combination with each controller in a ring shape, higher speed processing is possible. Here, as one embodiment, a man-machine apparatus and each controller are connected by a single network, and a method of including a destination of abnormal information when an abnormality occurs in the abnormal information is used.

  FIG. 36 shows the configuration of the communication interface of each controller. The input information filtering unit 4030 screens unnecessary input information, and 4031 screens unnecessary output information. An output information filter 4032 for preventing unnecessary output information from being transmitted to the network is a communication processing unit for restoring encrypted and information-compressed information. These processes are executed by the NCP 40 in the controller shown in FIG. 7 and by the run adapters 86, 89, 92, and 95 in the controllers shown in FIGS.

  Here, a method using a constraint variable set will be described as an example of screening unnecessary output information. Here, the constraint variable set refers to all the variables defined in the constraint expression. For example, if the constraint variable set of the constraint condition C1 in FIG. 35 is V (C1), V (C1) = {X1, X2, X3}. Since the error variable e1 is artificially introduced to indicate the error range, it is not included in the constraint variable set.

  Based on the inclusion relation of the constraint variable set, it is determined whether or not an abnormality detected in each distributed control system is transmitted to another individual controller and the man-machine apparatus 1200 via the network. However, since this information alone is not sufficient, input / output variable information in each distributed control system is also used. That is, when sending abnormal information to the network, as shown in FIG. 37, in addition to the constraint variable set, information on the input variable set, expanded variable set, erase variable set, abnormal information data ID, and device ID is also added To do. Here, the input variable is an input variable in each controller in which an abnormality has occurred. If the input variable in the controller 1 is In (1), In (1) = {X1, X2}. The expansion variable and the erasure variable are information added when the abnormal variable is narrowed down when the abnormal information is received from another controller, and will be described in detail later. The abnormal data ID is information for indicating when this data frame is data of a type called abnormal data and is AB_92_07_03_10_24_10 here. AB indicates abnormal information, and the subsequent numbers indicate that the abnormal information was transmitted at 10:24:10 on July 3, 1992. The transmission destination ID indicates whether the abnormal data is for a man-machine device or for each controller. For example, if it is for a man-machine device, 0 is written here, if it is for each controller, here, and the device ID describes the ID of the controller that issued this abnormality information. In this case, since it is transmitted from the controller 1, “1” is entered.

  When such abnormal information is transmitted to the network, each controller determines whether the information is related to itself in the input information filter, and if it is related, takes it in. On the other hand, only the abnormal data ID, the constraint variable set, the device ID, and the input variable set in the abnormal information data format are sent to the man-machine apparatus immediately without being processed.

  In the following explanation, using the current example, we first show how unnecessary abnormal information is suppressed from being sent to the network, and then how abnormal points are identified. Indicates whether

  First, unnecessary information suppression processing is shown in FIGS. FIG. 38 shows an outline of the processing. With reference to the abnormality information registered in the man-machine apparatus, it is determined whether or not the abnormality information to be newly transmitted is included in the already transmitted information. Determine, and if it is included, stop sending. FIG. 39 shows a process for determining the inclusion relationship between abnormal information. First, it is checked whether there is an inclusion relationship between the constraint sets. If there is no inclusion relationship, there is an input / output relationship between the controllers. Considering this input / output relationship, an inclusion relationship may be established, and this determination is also made. These processes are shown by specific examples.

  First, let us consider a case where the above-described abnormality information is transmitted from the controller 1 as two data frames destined for the man-machine device and for each controller and has already been received by the man-machine device. As described above, the other controllers 2, 3 and 4 also detect constraint violations and attempt to transmit abnormality information. For example, in the controller 2, the constraint condition C4 is not satisfied. The constraint variable set of this abnormal information is V (C4) = {X5}, and the input variable set is {X3, X4}. Before transmitting this information, the output information filter unit of the communication interface of the controller 2 refers to the abnormality information of the man-machine device and has a constraint variable set including the constraint variable set of the abnormality information that the user wants to transmit. Check whether the error information has already been sent. In this case, V (C1) = {X1, X2, X3} of the constraint variable set of abnormality information transmitted from the controller 1 does not include V (C4). However, when the input / output relationship is taken into consideration, the results are different. That is, since the input variable X3 of the controller 2 belongs to the constraint variable set V (C1) of the abnormality information transmitted from the controller 1, the output variables X5 and X6 of the controller 2 are abnormal due to the influence of the input variable X3. It can happen.

On the other hand, since the input variable of the abnormality information of the controller 1 is {X1, X2}, the cause of the abnormality related to the output variable X5 of the controller 2 is caused by the input variable X1, of the controller 1 via the output variable X3 of the controller 1. It may be X2. That is, for the controller 2, in addition to V (C1) = {X1, X2, X3}, Op (C1,2) = {X5, X6} is also a constraint variable. Here, Op (C1, 2) is a virtual constraint variable of the constraint condition C1 for the controller 2, and is referred to herein as an expanded variable set. Therefore, since V (C1) U _Op (C1,2) includes V (C4), the unsatisfied constraint C4 is information included in the information regarding the unsatisfied constraint C1 that has already been transmitted. Thus, in order to prevent data from overflowing on the network, the output information filter unit is screened and not transmitted.

Similarly, the controller 3 does not satisfy the constraint condition C6, and tries to transmit it to the network. However, since the abnormality information has already been transmitted from the controller 1 to the man-machine apparatus, the output information filter of the controller 3 determines whether or not the abnormality information that it has is worth transmitting. At this time, as in the controller 2, when Op (C1, 3) is obtained, the controller 3 has the output variable X3 of the controller 1 as an input variable, so the output variable X7 of the controller 3 is also a virtual constraint. Since it is a variable and Op (C1,3) = {X7} and V (C1) U _Op (C1,3) includes V (C6), the abnormality information regarding the constraint condition C6 is not transmitted. Further, for the controller 4, Op (C1,4) = {X8, X9}, and V (C9) is included in V (C1) U _Op (C1,4). Therefore, abnormality information for not satisfying the constraint condition C9 is not transmitted. In this way, it is possible to suppress the occurrence of duplicate abnormality information.

  Next, a method of narrowing down abnormality information using already transmitted abnormality information will be described with reference to FIG. When the abnormality information is transmitted from a certain controller, the data is divided into one that goes directly to the man-machine device and one that is broadcast to each controller. The abnormality information is narrowed down to abnormality information broadcast to each controller. First, each controller determines whether the information on the network is related to itself.

First, abnormality information on the data bus is taken into the communication interface of the controller, and the taken abnormality information is deleted from the network. In the communication interface, first, in the communication processing unit, the data is converted from a compressed state to a processable state, and then it is determined whether or not the input variable in the abnormal information data is an output variable. The controller input variable is added to the abnormality information as an expanded variable. In this example, the input variable set of abnormality information generated from the controller 1 is X1 and X2, and these are No because the controller 2 does not have an output variable. Next, it is determined whether or not there is a constraint condition in the constraint variable set included in the constraint variable set included in the constraint set of the abnormality information. Since this is also No, the abnormality information is not transmitted to the network without processing the abnormality information. Is returned. That is, it is filtered by the input filter and no processing is performed. In the present example, the other controllers do not perform any processing in the same manner, and the abnormality information of the constraint C1 transmitted first passes through the network in its original form. On the other hand, as described above, in this case, other constraint violations will be transmitted to the output router, and will not be transmitted. Therefore, even if there is no narrowing down, the cause must be identified in the controller 1 from the beginning. Can do.
On the other hand, it is assumed that, for some reason, for example, the abnormality information of C6 constraint condition violation of the controller 3 is transmitted earlier than the controller 1. The constraint variable set of the abnormal information is V (C6) = {X7}, and the input variable set In (3) = {X3, X5}. When this abnormality information comes to the controller 1, the controller 1 has the input variable X3 as an output variable (such a variable is called a common variable), so the controller input variables X1, X2, and are added to the expansion variables. . In the next determination, the union of the constraint variable set {X7} of the abnormal information and the expanded variable set {X1, X2, X3} includes the constraint variable set {X1, X2, X3} of the constraint condition 1. Is processed by the processing procedure of FIG. At this time, the constraint condition C1 is included in the constraint condition C6. First, it is determined whether or not the constraint condition C1 included in the received constraint condition is satisfied. In this case, since it is not satisfied, it is next checked whether or not the constraint condition C1 is transmitted. If C1 is sent first, C6 is not sent by the process already described, but if C6 is sent first, C1 could be sent. If C1 has already been transmitted, the received abnormality information is erased, and if it has not been transmitted yet, the abnormality information is rewritten to that relating to C1. In either case, only the constraints on C1 survive on the network. In other words, this indicates that the cause of the abnormality has been narrowed down to the controller 1.

  In addition, the cut of unnecessary information transmission and the narrowing down of the cause of abnormality as described above can also be realized by installing knowledge about the inclusion relation of abnormality information in the input / output filter part of each controller and the man-machine device. it can.

  For example, it is assumed that the knowledge expressing the constraint inclusion relationship in a tree as shown in FIG. 42 is prepared, and the unsatisfied constraint name is described instead of the constraint variable set in the abnormal data format of FIG. For example, if the already registered abnormality information includes the abnormality information to be transmitted by using the constraint expression name of the abnormality information already registered in the man-machine apparatus instead of the processing of FIG. The transmission of unnecessary abnormality information can be suppressed by only adding the abnormality information of the integrated monitoring apparatus without transmitting to other controllers.

Furthermore, another embodiment of the distributed control system of the present invention aimed at improving reliability and fault tolerance will be shown. The present invention enables an operating controller to autonomously distribute and back up a load even when multiple controllers of a distributed control system are down. Means for realizing this backup is shown in FIG. FIG. 43 shows an embodiment of the present invention in which a running controller autonomously distributes and backs up a load against multiple downs of controllers in a distributed control system.
Controllers 1, 2, 3, and 4 that are connected to the sensors of the plant 100 and control targets to control them constitute a distributed control system connected to each other via a network 1000. The controllers 1, 2, 3 and 4 are respectively communication means 6110, 6210, 6310, 6410, backup request means 6120, 6220, 6320, 6420, backup acceptance means 6130, 6230, 6330, 6430, schedulers 6140, 6240, 6340, 6440, control means 6150, 6250, 6350, 6450, storage means 6160, 6260, 6360, 6460, internal backup means 6170, 6270, 6370, 6470, and disconnecting means 6180, 6280, 6380, 6480 Since each controller including the above has the same configuration, the controller 1 will be described as a representative example. Each controller has four processors as shown in FIG. 47 described later. Further, each processor has sufficient hardware to provide the communication means, backup request means, backup acceptance means, internal backup means, disconnection means, scheduler, and control means shown here, and provide each means. It has enough processing power to execute the software (task) to be executed. Therefore, the above means can be implemented on any processor. The function of each means will be described below.

  The communication unit 6110 is connected to the network 1000, the backup request unit 6120, the backup reception unit 6130, the scheduler 6140, the control unit 6150, the storage unit 6160, the internal backup unit 6170, and the disconnection unit 6180, and exchanges messages with other controllers. To enable the exchange of messages or data between other means in the controller and the other controller. The scheduler 6140 determines and instructs the order in which a plurality of tasks registered in itself are allocated to the processor, the time interval, and the like. The control means 6150 controls the sensor and control target of the plant 100. The scheduler 6140 and the control unit 6150 are connected to the storage unit 6160, and control the scheduling, the plan, and the 100 based on the tasks and data stored therein and the scheduling information. The scheduler 6140 and the control unit 6150 are connected to the communication unit 6110 and exchange messages with other controllers via the communication unit 6110 and the network 1000 in order to synchronize with other controllers. In this embodiment, distributed control is performed as described above.

  The means for managing backup will be described.

  The disconnecting unit 6180 is connected to the internal backup unit 6170 and the communication unit 6110. This means detects a down such as a hardware failure in the controller or a software runaway, and stops the operation of the down processor. The same operation is also performed when a failure of a controller including itself is notified from another controller via the network 1000. The disconnecting means 6180 is connected to the communication means 6110 so that the backup can be started by notification of a failure from another controller. Furthermore, both when the failure is detected by itself and when the failure is notified, the internal backup unit 6170 is notified through the connection of which processor is down.

  In addition to the functions described above, the scheduler 6140 measures the execution time per unit time for each task executed by the processor in the controller, and the ratio of the value to the unit time is determined as the load factor of each task. And The task load table described later is updated with this value. Then, when the sum of these load factors exceeds a limit load factor, which will be described later, it is predicted that an overload will occur in the processor. Further, overload is detected by determining whether or not the sum of the load factors of each task exceeds 100% in the processor. If it exceeds, the load is overloaded. The internal backup means 6170 is notified of the processor that is predicted to cause an overload or the processor that has experienced an overload.

  The internal backup unit 6170 is connected to the communication unit 6110, the storage unit 6160, the disconnection unit 6180, the scheduler 6140, and the backup request unit 6120. This means is in accordance with the procedure of FIG. 44 when the disconnection means 6180 is notified of the internal down of the controller, or when the scheduler 6140 is informed of the occurrence of overload in the controller or the prediction of overload. Tasks that cannot be executed due to over are backed up in the controller according to their priority. In order to prevent a partial down or overload from leading to a down of the entire controller, priority is given to tasks essential to the management operation of the controller. In order to prevent the occurrence of bottlenecks in the communication amount of the network 1000 and frequent communication delays or failures, tasks that require a large amount of communication when backed up by another controller are prioritized. Backups are performed in order from the processor with the lightest load, and as long as there are tasks to be backed up, they are performed one after another on the processor with the heavier load. If there are no more tasks to be backed up on the way, the process ends there. If a task to be backed up remains after all the processors have been backed up, the backup request means 6120 is notified of this situation and the procedure for backup between the controllers in FIG. 45 is executed. Exit. The procedure shown in FIG. 44 is referred to as an internal backup procedure, and the details thereof will be described later with a specific example. Here, the outline of the function of this means will be described.

  First, in step 6510 to step 6515, this means determines a processor in charge of backup of a task that cannot be executed due to down or overload from the controller. In this determination, information on the execution state of each processor stored in the storage unit 6160 is used. That is, in order to back up many tasks, a processor with a low load or a processor with a large surplus performance is determined. These pieces of information are stored in a table called an execution allocation table shown in FIG. Further, a task to be backed up is determined among tasks that cannot be executed due to down or overload. In this determination, information on task attributes is used to exclude tasks that need not be backed up by other processors. Information regarding the task attributes is stored in a table called a task load table shown in FIG.

  Subsequently, in step 6520 to step 6540, the means adds a plurality of tasks executed by the portion in charge of backup before backup to the task to be backed up. From these, the processor in charge of backup selects a task to be executed after backup according to the priority. At this time, in order to prevent a partial down or an overload from causing the entire controller to go down, tasks essential to the management operation of the controller, such as a task for providing the communication unit 6110, the backup request unit 6120, and the scheduler 6140, are performed. Select with the highest priority. In order not to cause a bottleneck in the communication amount of the network 1000 and cause a communication failure, a task that requires a large amount of communication when backed up by another controller is selected first. . Then select other tasks. In each priority, a task is selected that has a maximum load as long as the load of the processor in charge of backup does not exceed the limit value. This load limit value is stored in the storage means 6160 and is called a limit load rate. In this selection, the load factor of each task stored in the storage unit 6160, the priority in this selection, and information on the original name of the task are used. The task load factor is the processing time required per unit time when the target task is executed by the processor, and is a value measured in advance when executed by a processor having the same processing capability or the part. is there. When measurement is not possible due to some reason, a value estimated and determined in advance is used. The original name of the task indicates the controller to which each task originally belongs or a part thereof. These pieces of information are stored in a table called a task load table shown in FIG. In this selection, even if the processor in charge of backup is a task that was executed before backup, it may not be executed after backup if the priority is low. The task thus evicted is added to the task to be backed up and waits to be backed up by another processor.

  Subsequently, this means registers the selected task in the scheduler 6140 in step 6550 and starts execution in the execution means 6150. The task evicted from the processor in charge of backup is deleted from the scheduler 6140 and its execution is stopped.

  Subsequently, in step 6560 to step 6590, this means executes three processes according to the status of the task to be backed up and the presence / absence of a processor not in charge of backup in the controller. First, if the task to be backed up has a high-priority task and the above procedure is not performed to make all the active processors in the controller take charge of the backup, the load factor is the next lowest The processor is selected as the processor in charge of backup, and the internal backup procedure is repeated again from procedure 6520. In order to be able to back up many tasks or many loads within the controller, this repetition of providing backup to each processor in the controller in turn was provided. On the other hand, when the task to be backed up is only a low priority task, and the task to be backed up has a high priority task, the above procedure for all the active processors in the controller to take charge of the backup In the case of performing the above, the connection state that the task to be backed up remains in the backup request means 6120 in order to broadcast the new execution status of the controller through the network 1000 and to back up the task to be backed up between the controllers. To start the procedure relating to the backup between the controllers in FIG. 45, and the processing of this means is terminated. On the other hand, if there is no task to be backed up, a new execution status of the controller is broadcast through the network 1000, and the processing of this means is terminated.

  The backup request unit 6120 is connected to the communication unit 6110, the storage unit 6160, and the internal backup unit 6170. When this means is notified that the task to be backed up remains from the internal backup means 6170, the backup request destination is sent from another controller or its processor connected to the network 1000 according to the procedure of FIG. Select and request a backup. This selection and request is repeated until the backup of all tasks is completed. This procedure is called a backup request procedure, and its details will be described later with a specific example. Here, an outline of the procedure will be described in order to explain the function of this means.

  In step 6610, this means uses the information on the load state of all the processors stored in the storage means 6160 to select the controller or the processor that requests backup. The selection criterion is the smallest load among the processors of other controllers. This information is stored in the external reception order table shown in FIG.

  Subsequently, in step 6620 to step 6640, the present means transmits a message 6600 indicating that a backup is requested to the request destination selected earlier. This message 6600 includes information on the task to be backed up. Message 6600 is sent over network 1000. Then, it waits for a response from the request destination. The response is a message 6700 indicating that the response is a response to the backup request, which is broadcast to the entire system by the request destination. The message 6700 further includes information indicating a task backed up by the request destination and a task (executed task) that is not executed at the request destination by this backup. This means is in a wait state until this message 6700 is received. When this message is received, the wait state is released and the process proceeds to the next step 6642.

  Subsequently, in steps 6642 to 6648, the means determines whether or not there is a task backed up by the request destination. If there is a task backed up by the request destination, a procedure for determining the end of the backup request (steps 6650 to 6670). ) If there is no task backed up by the request destination, it is further determined in step 6644 whether all the processors of other controllers have requested backup. If all of the other controller's processors have not been requested to be backed up, in step 6646, the other controller's processor having the next smallest load is designated as the next backup request destination. Returning to the procedure 6620, the backup request is repeated. Further, when all the processors of other controllers are requested to perform backup, the backup has failed. Therefore, in this case, as shown in step 6648, the degenerate operation means starts the degenerate operation, and this means ends the backup request procedure.

If there is a task backed up by the request destination in the determination of step 6642, then this means is stored in the storage means 6160 in steps 6660 to 6670 in response to the message 6700 from the request destination. Change each table. Further, the task backed up by the request destination is deleted from the task to be backed up, and the task evicted from the request destination is added to the task to be backed up. Thereafter, the presence / absence of a task to be backed up is determined. When there is a task to be backed up, the process returns to step 6610 to repeat the selection of the request destination and the request for backup. By repeating this request and rejecting or accepting the request destination, the tasks to be backed up can be autonomously distributed and backed up.
The backup accepting unit 6130 is connected to the communication unit 6110 and the storage unit 6160. When this means receives a message 6600 for requesting backup sent from another controller via the network 1000, it is requested to back up the task requested for backup by the message 6600 according to the procedure of FIG. Back up according to the processor load status. In this procedure, the task requested to be backed up and the task being executed by the processor are also exchanged so that the load factor of the processor in charge of backup is as large as possible without exceeding the limit load factor. This replacement is a function necessary for backing up a task with a considerably large load factor. Even if there is no room for backing up a task with a large load factor, it is often possible to back up a task with a large load factor by creating a margin for expelling a task with a small load factor. The evicted task will be requested to be backed up by another processor as a task to be backed up and executed there. Alternatively, it may cause a replacement, but with each replacement, tasks with a smaller load factor are kicked out, so the possibility of backup will increase and eventually backup will be possible. If this task replaces a task that is indispensable for the management and operation of its own controller or a task that requires a large amount of communication when it is executed by another controller, its controller will go down or the network 1000 will become a bottleneck of traffic. It may cause a communication failure due to a neck. In order to prevent this, it was set as this procedure which selects those tasks preferentially as a task performed after backup. Further, this means informs the entire system of the backup result. This procedure is called a backup acceptance procedure, and details thereof will be described later with a specific example. Here, an outline of the procedure will be described in order to explain the function of this means.

  In step 6710 to step 6730, this means prioritizes a task to be executed by the processor in charge of backup after the backup from among a plurality of tasks to be backed up and a processor in charge of backup. Select accordingly. At this time, in order to prevent the own controller from being down due to the backup, the tasks essential to the management operation of the own controller such as the task of providing the communication unit 6110, the backup request unit 6120, and the scheduler 6140 are given the highest priority. select. Tasks that require a large amount of communication when executed on other controllers are selected next in order to prevent a bottleneck in the communication amount of the network 1000 from becoming obvious and causing a communication failure. . Then select other tasks. In each priority, a task is selected that has a maximum load as long as the load of the processor in charge of backup does not exceed the limit value. This load limit value is stored in the storage means 6160 and is called a limit load rate. This selection is the same as the procedure 6530 of the internal backup procedure of FIG. In this selection, even if the processor in charge of backup is a task that was executed before backup, it may not be executed after backup if the priority is low. Subsequently, this means registers the selected task in the scheduler 6140 and causes the execution means 6150 to start execution. The task evicted from the processor in charge of backup is deleted from the scheduler 6140 and its execution is stopped.

  Subsequently, in step 6740, this means broadcasts a message 6700 including information indicating a task to be backed up and a task to be kicked out on the network. This message 6700 informs all of the other controllers of the change in the execution state of its own controller. Further, in this means, all controllers rewrite the execution assignment table, task load table, and external reception order table stored in the respective storage means 6160, 6260, 6360, 6460 by this message 6700. Further, as described above, based on this message 6700, the requesting backup request means (any one of 6220, 6320, 6420) deletes the backed up task from the task to be backed up, and the evicted task is backed up. Add to the task to be done.

  In this way, multiple tasks executed by one down or overloaded controller are divided according to the load of the operating controller requested to be backed up, and finally backed up by multiple controllers Is done. That is, in the distributed control system of the present invention, a plurality of operating controllers share the backup or load over of one controller in accordance with their own load status for backup. Further, in order to suppress an increase in network traffic in this backup, the backup is performed in accordance with the attribute relating to the task traffic.

  FIG. 47 shows the physical configuration of this distributed control system. The controllers 1, 2, 3, and 4 have the same configuration, each of which is a network connection connector 41a, 41b, 41c, 41d connected to the network 1000, and each of these network connection connectors and a serial data bus. Four processors (PR1, PR2, PR3, PR4) 701 to 704, 711 to 714, 721 to 724, 731 to 734 connected via 71a, 71b, 71c, and 71d, and these processors (PR1, PR2, PR3, PR4) and global memories 82a, 82b, 82c, 82d connected to the buses 70a, 70b, 70c, 70d, and inputs / outputs connected to these processors (PR1, PR2, PR3, PR4) Processing devices (I / O) 83a, 83b, 83c, 83d and their processors And a bus 70b for notifying failure. Each controller was named DC1, DC2, DC3, DC4. Each processor in each controller is named PR1, PR2, PR3, PR4. Here, it is assumed that each processor executes a task described therein. Here, the tasks NC1, NC2, NC3, and NC4 are tasks for controlling transmission and reception of messages between the controllers via the network 1000, and provide communication means 6110, 6210, 6310, and 6410 in FIG. Tasks CM1, CM2, CM3, and CM4 are tasks that control the execution of tasks in the controllers 1, 2, 3, and 4, and backup request means 6120, 6220, 6320, and 6420 in FIG. 6130, 6230, 6330, 6430 are provided. A task whose initial begins with T is a control operation executed by each controller, and provides the control means of FIG. A task that starts with an OS such as the OS 11 is a real-time operating system incorporating a backup-related function, and is executed by each processor. Each of these provides the internal backup means 6170, 6270, 6370, 6470 of FIG. In addition, each of these real-time operating systems independently performs scheduling for each processor. In other words, the schedulers 6140, 6240, 6340, and 6440 of each controller are provided by being divided into portions related to the respective processors.

  Further, the fault control circuit 6820 (see FIGS. 8, 10, and 12) in each processor provides a disconnecting means by using the bus 70b as a communication path in cooperation with the fault control circuits of other processors. For example, when the processor 702 in FIG. 47 fails, the failure control circuit of the processor 702 detects the failure and notifies the other processors 701, 703, 704 of the failure of the processor 702 through the bus 70b, and at the same time, the processor 702 The operation of the general-purpose engine (GE) is stopped. Further, the respective failure control circuits of the processors 701, 703, and 704 cause the tasks OS11, OS13, and OS14 that provide internal backup means executed by the respective processors PR to start the internal backup procedure. As described above, the function of the separating means 6180 in FIG. 43 is physically shared by the four processors.

  Further, since all the processors in each controller of FIG. 47 have a run adapter (LA), any of the processors can operate as the communication means 6110, 6210, 6310, 6410. In the prior art, the communication-related means is not made redundant and the reliability is insufficient. However, the configuration of this embodiment makes it redundant and improves the reliability. Of the four run adapters (LA) in each controller, the ones that actually become the communication means 6110, 6210, 6310, 6410 are the run adapters (LA) of the processors on which the tasks NC1, NC2, NC3, NC4 are executed. It is. That is, even if the run adapter (LA) operating as a communication means breaks down and communication is interrupted, communication can be recovered by backing up the tasks NC1, NC2, NC3, and NC4 in the controller. Further, in the prior art, when the processor or the processor has a local memory, there is a problem that if the processor or the processor is down, the learning data for control stored in the local memory cannot be accessed. Therefore, the local memory (LM) 6816 is composed of a dual port memory and connected to the bus 70a in addition to the bus 6819. With this connection, the local memory (LM) 6816 can be accessed from another processor via the bus 71a. The storage means 6160, 6260, 6360, and 6460 of FIG. 34 are comprised by the local memory (LM) and global memory (GM) of four processors (PR1, PR2, PR3, PR4) in a controller.

  Hereinafter, the backup method of this embodiment will be illustrated in detail. FIG. 48 is an execution assignment table in the operation state of FIG. 47 and is stored in each storage means 6160, 6260, 6360, 6460. The contents of this table are the name that identifies the processor, the name of the task that the processor is executing, the load factor that the processor incurs due to those tasks, and the number in the order of lightest load on each processor in each controller. (Number of internal loads). In this example, the controller name and the processor name are concatenated so that the processor can be specified. There are other methods for specifying different numbers. The method used to specify the processor may be any method regardless of the gist of the present invention. Using this table, the internal backup means 6170, 6270, 6370, 6470 retrieves the task to be backed up from the processor name that has gone down or overloaded, and takes charge of the backup in order from the processor with the smallest load to the processor with the largest load. Search the internal load order to make it. Further, the backup assignment means 6130, 6230, 6330, 6440 uses the execution allocation table to search the task name being executed by the processor from the processor name requested to be backed up. Even if there is no internal load order, the internal backup means can generate information equivalent to the internal load order based on the processor name and load factor and execute the above processing. It takes longer time to complete the backup. In order to shorten the time until the backup is completed, in this embodiment, an internal load order is generated and stored in this execution assignment table in the normal operation state.

FIG. 49 is a task load table in the operation state of FIG. 47 and is stored in each storage means 6160, 6260, 6360, 6460. The contents of this table are the name of the task, the load factor when the task is executed, the attributes related to the backup, and the original register indicating which processor the task belongs to. There are four attributes, "fixed" indicating that the task is indispensable for the original processor, but does not need to be backed up by another processor (or must not be done), and the task required for the management operation of the controller “Internally” indicating that the communication amount is large, “communicative” indicating that there is a large amount of communication, and “somewhere” indicating that the task may be executed by a controller other than the original bank. Therefore, the task to be backed up by another processor is one whose attribute is not “fixed”. If these are treated as priorities in a certain processor and arranged in descending order from the highest priority, the one with the highest priority is "fixed"
The next priority is "internally" where this processor is the original, the next priority is "communicative" where this processor is the original, and the lowest priority is this processor. “somewhere” and “fixed”, “internally”, “communicative” and “somewhere”, where this processor is not the original. However, the attribute is “fixed” or “internally” for processors other than the original register.
Backing up these tasks causes problems with the controller or system, so this is prevented during the backup procedure. That is, backup is performed with the highest priority by the original processor or a controller including the processor (referred to as an original controller). The internal backup means 6170, 6270, 6370, 6470, and the backup reception means 6130, 6230, 6330, 6440, and the priority of each task from the task to be backed up and the task executed by the processor in charge of the backup, This task load table is used to know the contents from the task name when selecting a task to be executed after the backup based on the master register and the load factor.

  FIG. 50 is an external acceptance order table in the operation state of FIG. 47 and is stored in each storage means 6160, 6260, 6360, 6460. In this table, the backup request means 6120, 6220, 6320, 6420 first searches for the name of the processor with the lowest load factor from the processors of other controllers, and then searches for the names of the ones with higher loads in order if necessary. Used to do. In this table, processor names are arranged in ascending order using the load factor as a key. Therefore, although the information of this table is included in the execution sharing table, it takes a considerable time to search for the processor having the smallest load factor in the execution sharing table. Therefore, this table is provided for the purpose of shortening the search time. In this table, it is possible to know the processor name of the minimum load factor among all the processors just by reading the first processor name. If it belongs to the controller requesting backup, it reads the next order. By repeating this, it is possible to select the processor with the smallest load among the processors of other controllers. This table is rewritten every time it is down or overloaded or backed up, but since it is sorted once, the ascending order of this table is maintained in three steps: deletion, two-minute search, and insertion. For this reason, when this external reception order table is used, it is not necessary to sort the contents of the execution assignment table at the time of backup, and the processing becomes faster. That is, the time required for backup can be shortened.

  Here, the relationship among the contents of the execution assignment table, task load table, and external reception order table will be described. Processor DC1. The tasks executed by PR1 are tasks OS11, NC1, CM1, and T11 from the execution allocation table. The load factor at this time is 5% for task OS11 from the task load table, 26% for NC1, 28% for CM1, and 13% for T11, so the sum of these is 72%. Assuming that the load factor of the processor omitted in the execution allocation table is sufficiently larger than this value, the processor DC1. Since the load factor of PR1 is third in ascending order, the rank is third in the external reception order table.

  Here, as an aid to understanding the backup procedure of the present embodiment, when the processor (DC1.PR1) 701 of the controller 1 is down as shown in FIG. 51, the tasks NC1, CM1, and T11 are divided and backed up. The process and the process in which the kicked task is backed up by another processor will be described. Here, it is assumed that the aforementioned limit load factor is set to 90%.

  (FD0) Assume that the processor 6811 of the processor 701 of the controller 1 has failed. Due to this failure, the communication unit 6110, the backup request unit 6120, and the backup reception unit 6130 are down, and parts of the scheduler 6140 and the control unit 6150 are down.

  (FD1) When the disconnecting means 6180 of the controller 1 detects that the processor 701 is down, this processor is stopped. At the same time, the internal backup means 6170 is notified that the processor 701 is down, and the internal backup means 6170 is caused to start the internal backup procedure of FIG.

  More specifically, when the failure control circuit (FD) 6820 of the processor 701 detects a failure of the general-purpose engine (GE) 6811, the failure control circuit (FD) of another processor is notified of the failure of the processor 701 through the bus 70b. Thereafter, the processor 701 is stopped. When the failure control circuit (FD) 6820 of each of the processors 702, 703, and 704 receives the notification of the failure, it requests an interrupt process from each processor 6811 using the interrupt request signal line of the bus 70a. This interrupt processing causes the tasks OS12, OS13, and OS14 that provide the internal backup means 6170 to start the internal backup procedure. Since the local memory (LM) 6816 of the stopped processor is connected to the bus 70a, it can be accessed from other processors even when this processor is stopped. This connection makes it possible to acquire data necessary for backing up and restarting tasks even when the processor is stopped.

  Hereinafter, the internal backup procedure shown in FIG. 46 executed by the internal backup unit 6170 will be described.

  (OS0) The internal backup means 6170 is activated. Specifically, the tasks that control the internal backup in all the active processors execute the internal backup procedure of FIG. 46 independently. In the example of FIG. 51, the task OS 12 executes the internal backup procedure in the processor (DC1.PR2) 702. In the processor (DC1.PR3) 703, the task OS 13 executes an internal backup procedure. In the processor (DC1.PR4) 704, the task OS 14 executes an internal backup procedure. The task that does not take charge of backup stops itself, and the one that automatically performs backup is determined. Since there is no specific dependency regarding backup between the processors, it is possible to make the inside of the controller uniform hardware and uniform software, and the construction of the controller becomes easy. Thus, the internal backup procedure of FIG. 46 was constructed. This determination method will be described in the next step.

  (OS1) Procedure 6510: The internal backup means 6170 determines the processor having the smallest load among the above operating processors as the processor that performs the backup.

  Specifically, each of the tasks reads out the internal load order of the processor and its own internal load order that are down from the execution allocation table. If the load of the down processor is the smallest, the internal load rank is No. 1 as described above. Therefore, if the internal load order is 1, the processor having the smallest load among the operating processors has the second internal load order. In this case, it is determined whether or not it is in charge of backup by determining that its own internal load order is No. 2. If the internal load order is No. 2, it is in charge of backup, and the procedure goes to step 6520. If the internal load ranking is not 2, the internal backup procedure is terminated and no backup is performed. On the other hand, when the load of the operating processor is smaller than the load of the down processor, the one having the smallest load among the operating processors has the first internal load rank. In this case, it is determined whether or not it is in charge of backup by determining that its own internal load ranking is No. 1. If the internal load order is No. 1, it is in charge of backup, and the procedure goes to step 6520. If the internal load ranking is not the first, the internal backup procedure is terminated and no backup is performed.

  In the example of FIG. 51, the internal load order of the down processor (DC1.PR1) 701 is No. 2 as shown in the execution allocation table of FIG. 48, and the internal load order of the processor (DC1.PR2) 702 is No. 4. The task OS 12 ends the internal backup procedure in step 6510. Also, since the internal load order of the processor (DC1.PR3) 703 is No. 3, the task OS 13 ends the internal backup procedure in step 6510. On the other hand, since the internal load order of the processor (DC1.PR4) 704 is No. 1, the task OS 14 proceeds from the procedure 6510 to the procedure 6520 and continues the internal backup procedure. Therefore, the processor (DC1.PR4) 704 first performs backup.

  (OS2) Procedure 6515: The internal backup means 6170 registers in the task queue those tasks that need to be backed up among tasks that cannot be executed due to down. Specifically, first, the task queue for reception is initialized. Then, the task name corresponding to the name of the down processor is read from the execution allocation table, and the load factor and attributes for those tasks are read from the task load table. Then, except for the “fixed” attribute indicating that the attribute does not need to be backed up or not to be backed up, it is registered in the reception task queue as a task to be backed up. In the example of FIG. 51, the name of the down processor (DC1.PR1) 701 is DC1. OS11, NC1, CM1, and T11, which are task names corresponding to PR1, are read from the execution assignment table, and the load rates of 5%, 26%, 28%, and 13% and the attributes “fixed” and “ “communicative” and “somewhere” are read out. Then, except for information related to the task OS 11 whose task attribute is “fixed”, these contents are registered in the reception task queue.

  (OS3) Procedure 6520: The internal backup means 6170 adds the task being executed by the processor in charge of backup to the reception task queue. Specifically, the task name corresponding to the name of the processor in charge of backup is read from the execution allocation table, and the load factor and attributes for those tasks are read from the task load table. These tasks are added to the reception task queue. At the same time, those load factors and attributes are also added.

  After this procedure, it is repeatedly executed until all processors in the controller are in charge of backup or until there is no task to be backed up. In the current execution in the example of FIG. 51, the names DC1. OS14, T17, and T18, which are task names corresponding to PR4, are read from the execution assignment table, and the load rates of 5%, 25%, and 26% and the attributes “fixed”, “internally”, and “communicative” are read from the task load table. "Is read out. These are added to the reception task queue.

  (OS4) Procedure 6530: The internal backup means 6170 selects a task to be executed after backup by the processor in charge of backup from the reception task queue. Specifically, the task queue for reception is rearranged according to the priority and load factor according to the task attributes, and the task that has the highest priority and the combination that is closest to the limit load factor is selected, and all are selected. If there is a margin in the load factor, a combination that is closest to the margin among the tasks of the next priority is selected. This combination and selection is repeated until some of the priority tasks cannot be selected. In the example of FIG. 51, the reception task queue has the contents shown in FIG. 52, and the task OS 14, NC1, CM1, and T17 are finally selected. Here, the tasks that are backed up are NC1 and CM1, the task that is not backed up is T11, and the task that is evicted is T18.

  (OS5) Procedure 6540: The task selected in the previous procedure is deleted from the reception task queue. Specifically, the name of the task, its load factor, and attribute selected in the previous procedure are deleted from the reception task queue. In the example of FIG. 51, the tasks OS14, NC1, CM1, and T17 are finally selected. In this procedure, these tasks are deleted from the reception task queue. The tasks left in the reception task queue are the task T11 that has not been backed up and the task T18 that has been evicted.

  (OS6) Procedure 6550: The task selected in Procedure 6530 is registered in the scheduler 6140 and execution is started. Specifically, a task to be backed up is additionally registered with respect to a task in charge of scheduling of a processor in charge of backup, and registration of a task to be evicted is deleted. In the example of FIG. 51, the task NC1 and CM1, which are tasks to be backed up, are additionally registered in the task OS14 which is a real-time operating system, that is, the task responsible for scheduling of the processor 704 responsible for backup, and the execution is started. In addition, the task T18, which is a task to be evicted, is deleted from the scheduler and execution is stopped. Here, the communication unit 6110, the backup request unit 6120, and the backup reception unit 6130 that have been down due to the failure of the processor 701 are recovered. Thereafter, communication with the network 1000 necessary for backup between controllers and execution of control tasks can be executed.

  (OS7) Procedure 6560: This procedure branches the internal backup procedure in three ways according to the backup status. One is a branch to the process of ending the procedure related to the backup because the backup is completely completed. The second is a branch to the process of completing internal backup and starting backup between controllers. The third is a branch to the process of repeating the internal backup. In the procedure 6560, these branches are executed by procedures 6562, 6564, and 6566. The procedure 6562 determines whether there is a task to be backed up, that is, a task having a high priority among the tasks remaining in the reception task queue, and if there is, the process proceeds to a procedure 6564. If not, the process proceeds to step 6566. In step 6564, it is determined whether or not all the processors in the controller are in charge of backup. If all of the processors are in charge, the process branches to the process of starting backup between the controllers in and after step 6574. If not assigned to all, the process branches to a process of repeating backup in the procedure 6580 and subsequent steps. In step 6566, it is determined whether or not a task to be backed up remains, that is, whether or not a task remains in the reception task queue. If a task remains, the process is a backup between controllers after step 6574. Branches to the process of starting. If no task remains, the process branches to a process for ending the procedure relating to backup after step 6572.

  In the example of FIG. 51, since the task T11 having the attribute “communicative” and high priority remains in the reception task queue this time, and the processor 704 is still in charge of backup, the procedure 6580 is performed. It branches to the process which repeats the internal backup after that.

(OS8) Procedure 6580: The processor with the next smallest load next to the processor in charge of the current backup is selected as the processor in charge of the next backup, and the process returns to step 6520 to perform the next backup. Specifically, the internal acceptance rank of the processor responsible for this backup and the internal acceptance rank of the down processor are read from the execution allocation table. Add 1 to the former value to obtain the next internal acceptance order. If this value is the latter order of acceptance, 1 is added to prevent the down processor from being designated. The processor whose internal reception order is this value in the controller is obtained from the execution allocation table. The obtained processor is selected as the next person in charge of backup. In the example of FIG. 51, the internal reception rank of the processor 704 responsible for the current backup is No. 1 and the internal reception rank of the down processor is No. 2, so the internal reception rank of the processor responsible for the next backup is No. 3. become. Therefore, the processor 703 whose internal reception order is No. 3 in the controller 1 in the execution allocation table is selected as the next backup.
The second internal backup starts from here. Each procedure already described describes only the explanation regarding the example of FIG.

  (OS9) Procedure 6520: In this execution in the example of FIG. 51, the processor 703 takes charge of backup. Therefore, the name DC1. OS13, T15, and T16, which are task names corresponding to PR3, are read from the execution assignment table, and the load rates of 5%, 28%, and 41%, and the attributes “fixed”, “somewhere”, and “communicative” are read from the task load table. "Is read out. These are added to the reception task queue.

  (OS10) Procedure 6530: In the example of FIG. 51, the reception task queue has the contents shown in FIG. 53, and the tasks OS13, T15, T16, and T11 are finally selected. Here, the task to be backed up is T11, the task that is not backed up is T18, and no task is evicted.

  (OS11) Procedure 6540: In the example of FIG. 51, the tasks OS13, T15, T16, and T11 are finally selected. In this procedure, these tasks are deleted from the reception task queue. The task left in the reception task queue is only the task T18 that has not been backed up.

  (OS12) Procedure 6550: In the example of FIG. 51, the task T11 that is a task to be backed up is additionally registered in the task that is responsible for scheduling of the processor 703 that is in charge of backup, that is, the task OS13 that is a real-time operating system, and the execution is started. Let In addition, since there is no task to be evicted, there is no task that is deleted from the scheduler and stopped.

  (OS13) Procedure 6560: In the example of FIG. 51, only the task T18 whose attribute is “somewhere” and does not need to be prioritized remains in the accepted task queue this time. That is, this state is a state in which no tasks with high priority remain, but tasks to be backed up remain. Therefore, this procedure branches the process to the process of starting backup between the controllers after step 6574.

  (OS14) Procedure 6574: Broadcast a message 6700 indicating a new execution state to the network 1000. This message allows other controllers to know that the processor is down and the new execution state of the processor responsible for the backup. In accordance with the contents of this message 6700, each controller modifies the execution assignment table, task load table, and external reception order table stored in each storage means. In the example of FIG. 51, the message 6700 indicates that the processor 701 is down as down information. Furthermore, the task OS13, T15, T16, and T11 executed by the processor 703 and the task OS14, NC1, CM1, and T17 executed by the processor 704 are shown as new execution statuses. FIG. 55 and FIG. 56 show the corrected execution assignment table and the external reception order table.

  (OS15) Procedure 6590: In order to perform backup between controllers, the backup request means 6120 is activated. Specifically, the remaining tasks to be backed up are moved from the reception task queue to the request task queue used by the backup request means 6120, and the reception task queue is emptied. Then, it notifies the backup request means 6120 that there are still tasks to be backed up. This notification may be performed using the inter-task communication function of the real-time operating system. Alternatively, it may be performed using message communication addressed to the own controller from the own controller via the nutwork 1000.

  (OS16) The internal backup procedure is terminated.

  Subsequently, the process proceeds to a backup procedure between the controllers, and the task T18 is backed up by another controller.

  (CM1) The backup request unit 6120 of the controller 1 is activated and starts executing the backup request procedure of FIG.

  (CM2) Procedure 6610: The backup request means 6120 uses the external reception order table to determine a backup request destination that has the smallest load among the processors of other controllers different from the non-controller that blows the down processor. Specifically, the name of the processor with the highest rank is read from the external reception rank table. If the processor belongs to another controller, reading is stopped there and the processor is used as a backup request destination. If it belongs to the same controller as the down processor, the processor name of the next rank is read again from the external acceptance rank table. Then, it is determined whether or not it belongs to another controller. The above is repeated until a processor belonging to another controller is read. In the example of FIG. 51, since the backup in the controller including the down processor has been completed, the external reception order table of FIG. 50 is changed to FIG. The name of the processor with the first rank is read from the external acceptance rank table of FIG. This name is DC2. PR2 and this processor belongs to the controller DC2. Since the controller including the down processor is DC1, the read processor belongs to a different controller from the controller including the down processor. Therefore, this processor (DC2.PR2) 712 is determined as the processor requesting the backup without returning to the process of reading the processor name of the next rank. This processor is called a request destination.

  (CM3) Procedure 6620: A message 6600 including information indicating that the backup request means 6120 is a backup request and information indicating all task names registered in the request task queue is created and sent to the request destination. Send to address. This message is called a request message. In the example of FIG. 51, the request message 6600 requests the backup of the task T18 and is sent via the network 1000 to the processor 712 that is the request destination.

  (CM4) Procedure 6630: The backup request unit 6120 waits for a message 6700 broadcast from the backup request destination as a reply to the message 6600 that requested the backup.

  Thereafter, until the message 6700 is broadcast, the backup request unit 6120 interrupts the backup request procedure and enters a waiting state. Hereafter, the operation of the backup receiving means 6230 of the request destination will be described.

  (CM5) In the controller 2 including the requested processor 712, the communication unit 6210 receives the message 6500 and activates the backup reception unit 6230. The backup reception unit 6230 starts the backup reception procedure of FIG. Here, the backup reception means 6230 uses a reception task queue and a task load table stored in the storage means 6260 of the controller including itself.

  (CM6) Procedure 6710: The backup reception means 6130 registers the task requested by the message 6600 and the task executed by the processor requested for backup in the reception task queue. More specifically, the backup receiving unit 6230 first initializes the receiving task queue in the storage unit 6260. Subsequently, the name of the requested task is extracted from the message 6600, and the load factor, attribute, and master account corresponding to the task name are read from the task load table in the storage means 6260, and the received task queue is initialized first. sign up. Further, the task name corresponding to the name of the requested processor is read from the execution allocation table in the storage means 6260, and the load factor and attributes for those tasks are read from the task load table. These tasks are added to the reception task queue. At the same time, those load factors and attributes are also added.

  In the example of FIG. 51, the name T18 of the task requested to be backed up by the message 6600 is registered in the reception task queue. At the same time, the load factor 26% corresponding to the name from the task load table and the attribute “somewhere” and the original DC Read PR4 and register them. Further, as the name of the task being executed by the processor 712 requested to backup, the processor name DC2. The task names OS22, T21, and T22 corresponding to PR2 are read from the execution assignment table. Further, from the task load table, the load rates corresponding to each task are 5%, 18%, 35% and the attributes “fixed”, “communicative”, “somewhere” and the original DC2. PR2, DC2.PR2, DC2. Read PR2. Then, these task name, load factor, attribute, and master register are added to the reception task queue.

  (CM7) Procedure 6720: The backup reception means 6130 selects a task to be executed after backup by the processor requested to be backed up from the reception task queue. Specifically, the task queue for reception is rearranged according to the priority and load factor according to the task attributes, and the task that has the highest priority and the combination that is closest to the limit load factor is selected, and all are selected. If there is a margin in the load factor, a combination that is closest to the margin among the tasks of the next priority is selected. This combination and selection is repeated until there is an unselectable task in any priority order, or until all tasks are selected. In the example of FIG. 51, the reception task queue has the contents shown in FIG. 54, and the task OS 22, T21, T23, and T18 are finally selected. Here, the task to be backed up is T18, there is no task that is not backed up, and there is no task that is evicted. That is, all the tasks in the reception task queue are selected.

  (CM8) Procedure 6730: The backup reception means 6130 registers the task selected in the previous procedure in the scheduler 6240 and starts executing them. Specifically, the task to be backed up is added and registered in the scheduler 6240, and its execution is started. Also, the registration of the task to be evicted is deleted from the scheduler 6240, and its execution is stopped. In the example of FIG. 51, task T18 is registered and execution is started. There is nothing to delete the registration.

  (CM9) Procedure 6740: The backup receiving means 6130 broadcasts a message 6700 indicating the new execution state of the processor requested for backup to the network 1000. This message 6700 is information indicating that it is an answer to the backup request, information on the task being executed by the processor requested to be backed up when the backup acceptance procedure is completed, and among the tasks requested for backup. It includes information indicating a task that has been backed up and information indicating a task that has been evicted from the processor requested to be backed up and whose execution has been stopped. The other controller knows the new execution state of the processor requested to be backed up by this message, and corrects the execution assignment table, task load table, and external reception order table stored in each storage means. Also, the backup request means 6120, which is the backup request source, exits from the waiting state by this message 6700, and resumes the backup request procedure. In the example of FIG. 51, a message 6700 indicates the tasks OS22, T21, T22, T18 being executed by the processor 712 as a new execution status. Task T18 is shown as the backed up task. Since there is no applicable task that has been evicted, this indicates that there is no evicted task.

  (CM10) The backup reception unit 6230 ends the backup reception procedure.

  Hereinafter, processing of the backup request procedure 6120 that has been resumed by the message 6700 will be described.

  (CM11) Procedure 6642: The backup request means 6120 extracts information indicating the backed up task from the message 6700. Then, it is determined whether there is a backed up task. If there is no task backed up, it is determined in step 6644 whether or not all processors have been requested to back up. If all the processors have not been requested, the external load order table is referred to in step 6646, and the processor with the next smallest load is selected as the requested destination after the current requested destination. Then, the backup request is repeated again from step 6620. In step 6644, if all the processors have been requested, the backup has failed, and the degenerate operation means is activated to perform the degenerate operation. Now, it returns to the procedure 6642. If there is a backed up task, the process proceeds to step 6650.

  In the example of FIG. 51, since the task T18 is backed up, the process proceeds to step 6650.

  (CM12) Procedure 6650: The backup request unit 6120 changes the execution assignment table, the task load table, and the external reception order table in the storage unit 6160 according to the contents of the message 6700. In the illustration of FIG. 51, the microphone and the computer DC2. Task T18 is added to the column of the task executed by PR2. Similarly, the load factor column is changed from 58% to 84%. Change the internal load order related to the controller 2 (DC2), and change the processor DC2. Set PR1 to No. 2, processor DC2. Set PR2 to No. 4, processor DC2. PR3 is the first, processor DC2. Set PR4 to number 3. In the external reception order table, the processor DC2. Since PR2 has a load factor of 84%, the load factor is turned backward, and the rank of processors with a load factor of 84% or less is incremented by one. Therefore, the processor having the first external reception order is DC3. It becomes PR1.

  (CM13) Procedure 6660: The backup request unit 6120 deletes the backed up task indicated by the message 6700 from the requesting task queue. In addition, the evicted task indicated by the message 6700 is added to the requesting task queue. This operation is provided so that all backups do not have to be completed by one backup request. In other words, if there is a task that could not be backed up in one backup or a task that was evicted to increase the load factor, the task remains in the request task queue, and this request is different from the current request destination. It was made to be able to request next time first. In the example of FIG. 51, the task T18 is deleted from the request task queue, and the request task queue becomes empty.

  (CM14) Procedure 6670: The backup request unit 6120 determines whether or not a task remains in the requesting task queue. If it remains, return to step 6610 again to determine a new request destination and request backup. If no task remains in the requesting task queue, the backup of all tasks has been completed. At this time, the backup request unit 6120 proceeds to the end of the backup request procedure.

  (CM15) The backup request unit 6120 ends the backup request procedure.

With the above steps, the distributed control system according to the present embodiment autonomously divides the tasks NC1, CM1, and T11 performed there in response to the down of one processor (DC1.PR1) 701 and assigns each to the controller 1 Backup (DC1.PR4) 704, controller 1 processor (DC1.PR3) 703, controller 2 processor (DC2.PR2) 712.
In the example of FIG. 51, the controller having the down processor is the same as the controller requesting the backup. However, according to the gist of the present invention, each of the controllers 1, 2, 3, and 4 has an execution allocation table that describes the execution states of all the controllers. It is possible for the controller to request backup from another controller. Specifically, in the example of FIG. 51, instead of the backup request means 6120 provided by the task CM1 backed up by the processor 704 of the controller 1, the backup provided by the task CM2 executed by the processor 711 of the controller 2 The request unit 6220 can request backup using the execution assignment table and the external reception order table stored in the storage unit 6260. For this reason, the execution assignment table, task load table, and external reception order table store the states of all controllers or all processors. In the example of FIG. 51, it is assumed that the backup request means of the controller that detects the down is activated.

  Although this embodiment is a system having four controllers, it can be extended to a system having two or more controllers without departing from the gist of the present invention. Further, in this embodiment, one controller includes four processors, but the present invention can be extended to a system having one or more processors without departing from the gist of the present invention.

The plant control system which is one Example of this invention. Conventional steel rolling control system. A steel rolling control system which is a specific application example of the present invention. An automobile control system which is another specific application example of the present invention. An automobile control system which is another specific application example of the present invention. 1 is a system configuration example when the present invention is applied to a hierarchical system. The internal block diagram of the controller which is one Example of this invention. The internal block diagram of the controller which is one Example of this invention. The internal block diagram of the controller which is another Example of this invention. The internal block diagram of the controller which is another Example of this invention. The internal block diagram of the controller which is another one Example of this invention. The internal block diagram of the controller which is another one Example of this invention. Block diagram of a functional programmable controller. A configuration example of a switch array in which connection between input and output is programmable using a nonvolatile memory. 11 is a configuration example of a memory cell in the switch array shown in FIG. An embodiment in which a spare area is provided in the switch array. The internal structural example of the processor which used the non-volatile memory for the microprogram memory. An embodiment in which each processor is configured by a combination of processor elements. The internal block diagram of I / O83. The block diagram which realized I / O83 with the semiconductor of 1 chip. The block diagram which realized I / O83 with the semiconductor of 1 chip. The block diagram which realized controller 1 'of this invention with the semiconductor of 1 chip | tip. The block diagram which realized controller 1 'of this invention with the semiconductor of 1 chip | tip. The figure which each shows the external appearance of the controller which is one Example of this invention. The figure which each shows the external appearance of the controller which is one Example of this invention. The figure which each shows the external appearance of the controller which is one Example of this invention. The figure which each shows the external appearance of the controller which is one Example of this invention. The basic block diagram of the control calculating part in this invention. 1 is an overall schematic diagram of a control calculation unit in the present invention. Configuration of output calculation unit. Configuration of the evaluation unit. The whole schematic diagram in the case of having a plurality of evaluation criteria. The basic block diagram in the case of producing | generating a weight value with a neural network. The distributed controller block diagram with a diagnostic function. The example figure of the constraint condition of each controller of a distributed system. The block diagram of the communication interface of each controller. Abnormal information format diagram. The process sequence figure of the abnormal signal transmission process at the time of restrictions unsatisfied. The process sequence figure of an unnecessary information determination algorithm. Diagnosis information take-in determination processing procedure diagram. Failure information processing procedure diagram. The example figure which shows the inclusion relationship of abnormality information. The logical block diagram of an autonomous distributed control system. Autonomous backup request procedure diagram. Autonomous backup acceptance procedure diagram. Internal backup procedure diagram. The physical block diagram of an autonomous distributed control system. The example figure which shows an execution allocation table. The example figure which shows a task load table. The example figure which shows an external reception order table. The example figure which shows the backup method of an autonomous distributed control system. The example figure of the task queue for reception in the 1st internal backup. The example figure of the task queue for reception in the 2nd internal backup. The example figure of the task queue for reception in the 1st external backup. The example figure which shows the execution allocation table after internal backup. The example figure which shows the reception order table after an internal backup.

Explanation of symbols

  1, 2, 3, 4, 5, 6, 6000... Controller, 40... NCP, 41a, 41b, 41c, 41d... Network connection connector, 52, 82, 82a, 82b, 82c, 82d. I / O, 54, 56, 58, 84, 87, 90, 93 ... processor, 55, 57, 59, 85, 88, 91, 94 ... local memory, 60, 61, 62, 63 ... bus expansion connector, 64 ... I / O connector, 70a, 70b, 70c, 70d ... bus, 71a, 71b, 71c, 71d ... serial data communication bus, 72a, 72b, 72c, 72d ... failure notification bus, 83a, 83b, 83c, 83d ... input / output processing devices (I / O), 86, 89, 92, 95 ... run adapters, 100 ... plant, 701, 702, 703, 704 Controller 1, 711, 712, 713, 714... Controller 2 processor, 721, 722, 723, 724... Controller 3 processor, 731, 732, 733, 734. ... input data from sensors, 2002 ... input data, 2003 ... output data, 2004 ... output data to actuators, etc. 2010 ... sensors, etc. 2011 ... input processing section, 2012 ... output calculation section, 2013 ... output processing section, 2014 ... Actuator, etc. 2015 ... Evaluation unit, 1200 ... Man-machine device, 2017 ... Pointing device such as touch panel and mouse, 2021 ... Weighting unit, 2022 ... Output data synthesis unit, 2101 ... Neural network, 2102 Output generation means 2, 2103 ... Output generation means 3, 2122 ... Weight value update signal, 6110, 6210, 6310, 6410 ... Communication means, 6120, 6220, 6320, 6420 ... Backup request means, 6130, 6230, 6330, 6430 ... Backup receiving means, 6140, 6240, 6340, 6440 ... scheduler, 6150, 6250, 6350, 6450 ... control means, 6160, 6260, 6360, 6460 ... storage means, 6170, 6270, 6370, 6470 ... internal backup means, 6180, 6280, 6380, 6480 ... disconnecting means, 6811 ... general purpose engine (GE), 6812 ... neural engine (NE), 6813 ... sequence engine (SE), 6814 ... run adapter (LA), 6815 ... Rerun timer (FRT), 6816 ... local memory (LM), 6817 ... bus interface (BIF), 6818 ... direct memory access control (DMAC), 6819 ... bus in processor, 6820 ... failure control circuit.

Claims (21)

  A distributed control apparatus characterized in that, in a process control apparatus having a plurality of control target devices, a controller that issues a control command to the control target device is installed on-site corresponding to each control target device.   In a controller for a control system composed of a plurality of processors, the plurality of processors in each controller have their own health / abnormality determination means and means for measuring or predicting the processor load, and one processor becomes abnormal or overloaded. A controller in which another processor performs load substitution when it is predicted or detected.   In a distributed control system having a plurality of controllers and a transmission means for connecting the controllers, at least one controller among the controllers is composed of a plurality of processors, and the plurality of processors in the controllers have their own health / abnormality determination means , Having means for measuring or predicting the processor load, and when one processor predicts or detects that the processor is abnormal or overloaded, another processor in the same controller performs load substitution Distributed control system.   In a distributed control system having a plurality of controllers and transmission means for connecting the controllers, at least one controller among the controllers is composed of a plurality of processors sharing memory or input / output, and the transmission means is a processor group in the controller A distributed control system configured to read and write the contents of the memory or input / output of the controller regardless of whether the controller is normal or abnormal.   In a distributed control system having a plurality of controllers and a transmission means for connecting each controller, at least one controller is composed of a plurality of processors, and the processor group includes a communication processor for controlling the transmission means, and the communication processor fails. A distributed control system, characterized in that the other processor is configured to replace the communication processor.   In a distributed control system having a plurality of controllers and a transmission means for connecting each controller, at least one controller is composed of a plurality of processors, and when one of the processors fails, another processor replaces the failed processor. A distributed control system characterized by being configured to do so.   In a controller for a control system comprising a plurality of processors, a first means (6180) for detecting a failure of each processor, a second means (6160) for storing the load status of each processor, and controlling the load on each processor And when the first means (6180) detects a failure of one processor, the second means (6160) stores the third means (6170) according to the load status of each processor. A controller characterized in that the third means (6170) divides and replaces the load of the failed processor with respect to one or more other processors.   In a controller for a control system having a plurality of processors and each processor executing a plurality of tasks, a first means (6180) for detecting a failure of each processor and a second state for storing the load status of each processor Means (6160) and third means (6170) for controlling the load of each processor, and when the first means (6180) detects a failure of one processor, the second means (6160) A controller characterized in that the third means (6170) selects and substitutes one or more other processors for the failed processor task in accordance with the load status of each processor stored in (1).   In the controller for the control system, which is composed of a plurality of processors and each processor executes a plurality of tasks, a first means (6180) for detecting a failure of each processor and a second state for storing the load status of each processor Means (6160) and third means (6170) for controlling the load of each processor, and when the first means (6180) detects a failure of one processor, the second means (6160) Each of the one or more processors from the task of the processor in which the third means (6170) has failed and the task executed by one or more other processors based on the load status of each processor stored in Selects a task to be executed by the processor, and the processors execute the selected task.   In a controller for a control system having a plurality of processors, first means (6140) for detecting the load of each processor, second means (6160) for storing the load status of each processor, and controlling the load of each processor When the first means (6140) detects an overload of one processor, the third means (6170) is provided according to the load status of each processor stored in the second means (6160). The third means (6170) divides the load of the processor that has been overloaded on one or more processors and substitutes the controller.   In the controller for the control system, which comprises a plurality of processors and each processor executes a plurality of tasks, a first means (6140) for detecting the load of each processor and a second means for storing the load status of each processor Means (6160) and third means (6170) for controlling the load of each processor, and when the first means (6140) detects an overload of one processor, the second means (6160) The controller is characterized in that the third means (6170) selects one or more processors to replace one or more processors according to the load status of each processor stored in (1).   In a controller for a control system having a plurality of processors and each processor executing a plurality of tasks, a first means (6140) for detecting the load of each processor and a second means for storing the load status of each processor Means (6160) and third means (6170) for controlling the load of each processor, and when the first means (6140) detects an overload of one processor, the second means ( 6160), one of the tasks of the processor overloaded by the third means (6170) and the tasks executed by one or more other processors based on the load status of each processor stored in 6160). A controller characterized by selecting a task to be executed by each of the processors and executing the selected task.   In a distributed control system having a network connecting a plurality of controllers and each controller, each controller measures a load of its own controller and transmits a measured load to the network. Any controller having second means (6120) for requesting another controller for replacement and third means for responding to the replacement request from another controller based on its own load status When a load overload or failure occurs, the second means of the controller that detects the load overload or failure determines a controller that requests the load replacement according to the load status transmitted from each first means, and replaces the load. The third means of the requested controller determines the alternative load according to its own load status. Distributed control system, characterized in that answer this alternative situation to control the execution of this load.   In a distributed control system having a plurality of controllers and transmission means for connecting the controllers, at least one controller is composed of a global memory or a plurality of processors sharing input / output, and the processor includes a cache memory and the contents of the cache memory. A distributed control system comprising global memory content matching means, wherein global memory contents or input / output contents can be read from another controller via the transmission means.   A distributed control system comprising a plurality of controllers and transmission means for connecting each controller, wherein at least one controller has input / output, and the connection of the input / output is programmable.   In a distributed control system having a plurality of controllers, at least one controller is composed of a plurality of processors, each of the plurality of processors having its own health / abnormality determination means and means for measuring the load of each processor. A distributed control system characterized in that when one processor is overloaded, the processor with the smallest load among the other processors substitutes for the load.   A controller for a control system having a plurality of processors, wherein at least one of the plurality of processors executes a neuro operation, a fuzzy operation, a numerical operation, or a sequence operation.   In order to exchange information of the memory between a plurality of processors each having a memory for storing information and each of the memories, each of the processors and an external network, a network is connected to the transmission line and at least one of the processors. And a means for setting a network control function for controlling information exchange between the memories, and a single processor specified by the means for controlling information exchange between the network and the memory. Feature controller.   In a control system for obtaining a control output using an input from a sensor or the like, a control output is obtained by weighting and summing a plurality of outputs calculated from a plurality of means or methods including at least one neural network from the input. An adaptive control system characterized by generating and updating the weighting value by learning.   In a distributed control system in which a plurality of controllers are connected via a network to execute control, each controller determines whether or not to transmit an abnormality detected by the plurality of controllers to the network based on information received from the network. Diagnostic method for distributed controller.   Single chip controller with multiple processors with programmable functions and interconnections.

Images