JP2008146236A - Duplex control device and redundancy method of its control right setting signal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a duplex control device which improves redundancy with simple structure for changing a control right and without making system composition complicated, and also provide a redundancy method of its control right setting signal. <P>SOLUTION: A first control right of its own system is set, and the first control right of its own system is reset from abnormal information on its own system and a second control right transmitted from another system. Control data mutually given to and received from another system in synchronization with the execution cycle of a control device are transmitted to another system, together with redundancy bit data generated from the first control right and the second control right which both accompany the control data, and the first redundancy bit data transmitted from its own system are compared with the second redundancy bit data received from another system, and the presence or absence of compatibility in setting signals between the first control right and the second control right, which are both set by the control device, is determined. If contradiction exists in the compatibility, the abnormal information on its own system is referred to, and the first control right of its own system is reset, and a control right setting signal is made redundant. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a redundant control device that controls the operation of a plant such as a power plant with two identical control programs, and more particularly, to a redundancy method for a control right setting signal of each control device.

  In a control device that controls the operation of various plants such as factories and public facilities, it may be predicted that some abnormality will occur in this control device and a serious accident will occur if the controlled plant stops. is there.

  In general, for such a control target, two sets of control devices having the same configuration are connected, and one of them is an active system, the other is a standby system, and normally the control target is controlled only by the active system, There is a standby redundant type redundant control device configured to switch a standby system to an active system and continue control when an abnormality occurs in the active system.

  In such a duplex control device, normally, an active control device receives input data to be controlled from an input / output device, executes a control operation on the input data, and uses the operation result as output data. Outputs to the input / output device.

  In addition, in the event of a failure of the active control device, control is continuously transferred from the active system to the standby control device, so that the control data being executed is synchronized from the active system to the standby system in synchronization with the execution cycle of the control device. And send it to the standby system.

  Furthermore, in order to determine the control right of the control device, that is, the active system to execute the control, the operating state of each control device is mutually exchanged, and when the active system fails, the standby system is switched to the active system The control is continued.

  By the way, the input / output device is configured by a plurality of units depending on the scale of the system, and in the case of a large-scale system, the proportion of the entire system configuration is very large. Therefore, in order to increase the reliability of the system, this input / output device may be duplicated.

  The conventional control device is configured as a standby redundant type redundant control device composed of two control devices and one or a plurality of input / output devices. If either of the control devices or the input / output devices fails, control is performed. However, it is not desirable that the system of the control device is switched due to a failure of the input / output device. The control device and the input / output device are independent of the failure of the own control device. Therefore, the possibility that the control can be continued with respect to the failure increases.

Conventionally, regarding the switching between the active system and the standby system, various proposals have been made regarding methods for transferring control rights. For example, according to the method disclosed in Japanese Patent Laid-Open No. 5-165667, there is a system in which each of the control device and the input / output device has a duplex switching function (see, for example, Patent Document 1).
JP-A-5-165667

  In the duplex control control device disclosed in Patent Document 1, both the control device and the input / output device are duplexed, and each has a duplex link. In addition, the redundant duplication control device is capable of fault masking against a single failure such as disconnection of individual duplication links or failure of individual devices.

  However, when the scale of the system is increased and the number of output points is increased, a plurality of input / output devices are required, so that there is a problem that a duplex link of the input / output devices becomes complicated.

  The present invention has been made to solve the above problems, and in a redundant redundant control device of standby redundancy, switching of control right has a simple structure, and redundancy is improved without complicating the system configuration. It is an object of the present invention to provide a control device and a redundancy method for the control right setting signal.

  In order to achieve the above object, the duplex control device of the present invention comprises two sets of control devices for a control target, one control device as an active system control device, and the other control device as a standby system control device. Normally, the control system controls the control target with an active system control device, and when this active system control device fails, it switches to the standby control device and controls the control target. The control device stores a control program and control data for executing control of the control target, and input data and output data between the control device and the input / output device via an I / O bus. The first control right of the own system and the I / O interface unit to exchange with each other are received, the second control right set in the other system is received, the abnormality information of the own system and the second control right And the first of its own system The control data and the status transmission processing unit associated with the control data are transmitted / received to / from another system in synchronization with the execution cycle of the control device. A tracking data transmission unit for exchanging redundant bit data generated from the first control right and the second control right with another system; and the first redundant bit data transmitted from the own system; A data transmission processing unit including a redundant bit data comparison unit that compares second redundant bit data received from another system, and reads out the control program from the memory unit, via the I / O interface unit Based on the input data that is input, a control operation is executed in the execution cycle, and the result is output to the I / O interface unit as the output data. The data transmission processing unit compares the first redundant bit data transmitted from its own system with the second redundant bit data received from another system by the redundant bit comparing unit. Determining whether or not there is consistency between the setting signals of the first control right and the second control right, and transmitting the determination signal to the status transmission processing unit, and the status transmission processing unit outputs the determination output of the redundant bit comparison unit And the abnormality information of the own system, the first control right of the own system is reset.

  In order to achieve the above object, a redundancy method for a control right setting signal of a duplex control device according to the present invention comprises two sets of control devices for a control target, one control device being an active system control device, and the other As the standby control device, the control target is normally controlled by the active control device, and when the active control device fails, the control target is switched to the standby control device to control the control target. A redundancy method of a control right setting signal of a standby redundant type redundant control device to be performed, wherein the first control right of the own system is set, the abnormality information of the own system and the second control right transmitted from the other system The first control right of the own system is reset from the above, and the control data exchanged with another system in synchronization with the execution cycle of the control device and the first control associated with the control data And a redundant bit data generated from the second control right The first redundant bit data transmitted from the local system is compared with the second redundant bit data received from the local system, and each is set by the control device. If there is a discrepancy in consistency between the first control right and the second control right, the first control right and the second control right are referred to. The control right is reset and the control right setting signal is made redundant.

  Redundant bit data transmitted from the local system and redundant bits transmitted from the local system are associated with the conventional control data accompanied by redundant bit data generated based on the control right transmitted from the local system and the remote system. Compared to the data, the consistency of the control right signal is judged to provide redundancy, and if there is a contradiction in consistency, the control right is reset, so the system configuration can be configured with a simple structure. It is possible to provide a redundant control device that improves the redundancy of the control right signal without making it complicated, and a redundancy method for the control right setting signal.

  Hereinafter, a duplex control apparatus according to the present invention will be described with reference to FIGS.

  FIG. 1 is a configuration diagram of a duplexing control device. The duplex control device includes two control devices 1a and 1b and an input / output device 2 connected to the control device 1a and the control device 1b via an I / O bus 2a. Control is performed by the device 1a and the control device 1b.

  Next, each part of the control device 1a will be described. About each part which comprises the control apparatus 1b, the same code | symbol is attached | subjected to the same part as the control apparatus 1a, and the description is abbreviate | omitted.

  Each control device 1a transmits input data and output data between the control device 1a and the input / output device 3 between the memory unit 12 that stores the control program of the control target 3 and the control data when the control program is executed. The I / O interface unit 13 exchanged via the / O bus 2a and the own system's abnormality information are received via the system bus 16 to set the control right of the own system and to each other. And a status transmission processing unit 14 for transmitting and receiving the control right signal to reset the control right of the own system.

  Further, in synchronization with the execution cycle of the control device 1a, the control data transmitted to the other system, the control right signal of the own system set by the status transmission processing unit 14 associated with the control data, and the other system are transmitted. A tracking data transmission unit 15a that exchanges the redundant bit data generated from the control right signal with another system, the redundant data transmitted from the own system, and the redundant bit data received from the other system Is set in advance based on the data transmission processing unit 15 including the redundant bit data comparison unit 15b for comparing the data and the control program is read from the memory unit 12 and input data is input via the I / O interface unit 13. The control calculation is executed at an executed cycle and the result is transmitted to the data transmission unit 15 and the result is used as the output data in the I / O interface unit Consisting calculating unit 11 for outputting a 3.

  Next, detailed configurations of the status transmission processing unit 14 and the data transmission processing unit 15 will be described with reference to FIG.

  The status transmission processing unit 14 sets its own control right and transmits it to the other system. The control right of the own system is an abnormality signal of hardware and software in the own system via the system bus 16, and a control right enabling signal for setting that control of the own system is possible at the beginning of operation of the control device 1a. A function of resetting the control right of the own system and transmitting it to the status transmission processing unit 14 of the other system from a consistency determination signal of redundant bit data transmitted from the data transmission processing unit 15 described later is provided.

  The data transmission processing unit 15 includes a tracking transmission processing unit 15a and a redundant bit data comparison unit 15b.

  The tracking transmission processing unit 15a includes a tracking memory 15a1 that primarily stores the control data calculated by the calculation unit 11 via the system bus 16, and a status transmission processing unit 14 that converts the control data stored in the tracking memory 15a memory. The redundant bit encoding unit 15a2 for attaching redundant bit data generated from the control right transmitted from the own system and the control right transmitted from the other system, and control data and redundant bit data are designated in advance. And a data transmission unit 15a3 that transmits to another system at an execution cycle.

  Further, the data receiving unit 15a4 that receives the control data transmitted from the other-system data transmission processing unit 15a and the redundant bit data associated therewith, and the other-system redundant bit data received by the data receiving unit 15a4 It comprises a redundant bit extraction unit 15a5 for extraction.

  Further, the redundant bit comparison unit 15b compares the redundant bit data transmitted from the own system with the redundant bit data of the other system transmitted from the data transmission processing unit 15a of the other system, and sets the control right setting signal. And the result is transmitted to the status transmission processing unit 14.

  Redundant bit data transmitted from the local system is transmitted to the redundant bit extracting unit 15a5 by outputting the output of the redundant encoding unit 15a2, where it is extracted in the same manner as the redundant bit data of the counterpart system, and is made redundant. It can be configured to transmit to the bit comparison unit 15b.

  Next, a configuration example of redundant bit data will be described with reference to FIG. The redundant bit data of the own system is provided by processing the control right information transmitted from the own system and the other system output from the own system status transmission processing unit 14 at the head or the end of the control data of the own system.

For example, when the control right signal set by the status transmission processing unit 14 of the own system is A and the control signal received from the other system is B, the logical inversion signals of these control right signals are A _{L and} B _L , respectively. , A _L, B, B _L A 4-bit signal is generated and assigned as a data string.

Similarly, when the control right signal set by the status transmission processing unit 14 of the other system is C and the control right signal received from the partner system is D, the logical inversion signals of these control right signals are C _{L and} D _L , respectively. , C, C _L, D, D _L A 4-bit signal is generated and applied.

  Then, the redundancy bit comparison unit 15a5 compares the assigned 4-bit redundancy bit data provided with the partner system and the 4-bit redundancy data received by the own-system data transmission processing unit 15a.

  When the control right signals are correctly exchanged with each other, the corresponding control right signals A and C and the control right signals B and D should be in inverted logic states. The bit data can be compared to determine the consistency of the state of the control right signal.

  Next, the setting of the control right and the operation of the duplex control apparatus configured as described above will be described.

  For example, it is assumed that the control device 1a holds the control right and is on the operating side. In this case, the status transmission processing unit 14 of the control device 1a receives the presence / absence of abnormality of its own hardware and software via the system bus 16.

  Then, the status transmission processing unit 14 receives the other-system control right signal indicating that the own-system controllable signal indicating that the own-system is in a controllable state is ON and that control has been transferred from the other system. Only when it is off, the own control right signal is turned on and the control right on the operating side is acquired.

  The own system controllable signal is turned on when the own system hardware is normal and the own system software is normal. The control device 1a or the control device 1b that previously set the own system controllable signal in the initial setting acquires the control right.

  That is, in the initial setting, the own system control right enable signal is turned on, and the control device 1a (or control device 1b) that has acquired the control right becomes the active side, and outputs the own system control right signal to the other system. Since control right acquisition is prevented, control right is not acquired at the same time.

  When the local hardware is not normal or the local software is not normal, the status transmission processing unit 14 turns off the local control right signal A so that the standby side obtains the control right and performs control. Rights are switched.

  Next, an operation when a disconnection or the like occurs in the transmission / reception system of the control right signal A for some reason and the other-system control right signal D from the other party is turned off in the standby control device 1b will be described.

  The status transmission processing unit 14 exchanges the redundant bit data associated with the control data via the data transmission processing unit 15 with the own system control right signal and the other system control right signal. The redundant bit comparator 15b compares the redundant bit data sent from the other system sent back through the same communication path with the redundant bit data sent from the own system.

  The comparison result is transmitted to the status transmission processing unit 14. When the status transmission processing unit 14 receives the mismatch determination signal from the redundant bit comparison unit 15b, if the own system has set the control right, the status transmission processing unit 14 does not switch the control right signal even if this mismatch occurs. Further, the standby status transmission processing unit 14 determines that the standby system is not switched to the active system because it is a standby system even if this inconsistency is received.

  The control data transmitted using the data processing transmission unit 15 and its communication path and the redundant bit data associated therewith are transmitted as data in which redundant bits of redundant bit data are multiplexed on the control data.

  Therefore, since the normality of the data can be determined by detecting the phase synchronization signal of these data and detecting or correcting the error by error check, the control right signal to be transmitted is transmitted correctly. Errors can be found or corrected.

  In addition, since the data transmitted / received from the data processing / transmission unit 15 transmits / receives a control right signal at a preset execution cycle of the arithmetic unit 11, the control right transferred via the status transmission processing unit 14. There is no mismatch due to time lag with the signal.

  In this way, an abnormality in the transmission system of the control right signal in the communication path between the status transmission processing units 14 can be determined, so that the active control device 1a is the active system and the standby control device 1b is the control system. Since the operation is continued in the standby system state where the right signal is turned off, both systems can be prevented from becoming the active system.

  In addition, even when noise is mixed in the communication path of the control right signal and the logic of the own control right signal and the other control right signal is temporarily reversed, the active control device is In order not to give up the control right, the control is continued as the active system, and the control data is continuously transferred to the standby system at a predetermined control cycle.

  As described above, according to the present invention, since the communication path between the status transmission processing units 14 can be configured with hardware as simple as possible, the probability of accidental failure can be reduced.

  Further, when the own system is an active system, even if an error occurs in the communication path between the status transmission paths 14 and an error occurs in the logic of the mutual control right signal, the data transmission processing units 15 The control right signal is compared with the redundant bit data in the communication path between them, the mismatch is detected, and the control right is reset.

  Therefore, a redundant control device that reduces the possibility of both systems becoming active or unnecessary switching, reduces the cost increase due to the addition of special hardware, and improves reliability only by the control device, and its Redundancy method of control right setting.

  The present invention is not limited to the above-described embodiment. The redundant bit data may be arbitrarily configured as long as the redundant bit data is generated from the control right signal, and the transmission / reception thereof may be performed. May be arbitrarily transmitted in a control cycle earlier than the execution cycle, and various modifications can be made without departing from the gist of the present invention.

The block diagram of the duplication control apparatus of this invention. Explanatory drawing of the redundant data transmission of the control right setting of the duplication control apparatus of this invention.

Explanation of symbols

1a, 1b Control device 2 Input / output device 2a I / O bus 3 Control target 11 Operation unit 12 Memory unit 13 I / O interface unit 14 Status transmission unit 15 Data transmission unit 15a Tracking data transmission processing unit 15a1 Tracking data memory 15a2 Redundant bit Encoding unit 15a3 Data transmission unit 15a4 Data reception unit 15a5 Redundant bit extraction unit 15b Redundant bit comparison unit 16 System bus

Claims (2)

Two sets of control devices are provided for the control target, one control device is the active control device, the other control device is the standby control device, and the control target is usually controlled by the active control device. When the active system control device fails, the standby control device switches to the standby control device and performs the control of the control target.
The control device includes a memory unit for storing a control program and control data for executing control of the control target;
An I / O interface unit that exchanges input data and output data between the control device and the input / output device via an I / O bus;
The first control right of the own system is set, the second control right set by the other system is received, and the first control of the own system is determined from the abnormality information of the own system and the second control right. A status transmission processing unit for re-setting
Synchronously with the execution cycle of the control device, the control data and the first control right and the second control right that are sent and received by the status transmission processing unit associated with the control data to and from other systems. A tracking data transmission unit that exchanges the generated redundant bit data with another system, the first redundant bit data transmitted from the own system, and the second redundant bit data received from the other system; A data transmission processing unit comprising a redundant bit data comparison unit for comparing
The control program is read from the memory unit, a control operation is executed in the execution cycle based on the input data input via the I / O interface unit, and the result is used as the output data as the I / O. It consists of a calculation unit that outputs to the interface unit,
The data transmission processing unit compares the first redundancy bit data transmitted from its own system with the second redundancy bit data received from another system by the redundancy bit comparison unit. The control right and the second control right are determined to determine whether the setting signal is consistent and transmitted to the status transmission processing unit, and the status transmission processing unit outputs the determination output of the redundant bit comparison unit The duplex control apparatus is characterized in that the first control right of the own system is reset from the abnormality information of the own system. Two sets of control devices are provided for the control target, one control device is the active control device, the other control device is the standby control device, and the control target is usually controlled by the active control device. When the active control device fails, it is switched to the standby control device, and the redundancy method of the control right setting signal of the standby redundant type redundant control device that controls the control object,
Set the first control right of the own system,
Re-set the first control right of the own system from the abnormality information of the own system and the second control right transmitted from the other system,
Redundancy bits generated from the first control right and the second control right associated with the control data and the control data exchanged with another system in synchronization with the execution cycle of the control device Send it to other systems with data attached,
A first control right and a second control right set by the control device by comparing the first redundant bit data transmitted from the own system with the second redundant bit data received from the other system, respectively. To determine whether the setting signal is consistent with
When there is a contradiction in consistency, the duplex control is characterized in that the first control right of the own system is reset by referring to the abnormality information of the own system and the control right setting signal is made redundant. A method for making a control right setting signal redundant for a device.

Images