JP2008305076A - Digital controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a digital controller for detecting a fault of a duplex status preparation circuit of a CPU, specifying a faulty system and the location of the fault and preventing adverse influence on a control state such as the hunting of output due to the fault in a CPU synchronizing duplex configuration. <P>SOLUTION: This digital controller is provided with: CPUs 1a and 1b composed of a primary system and a secondary system having control processing parts 20a and 20b and status preparation circuits 11a and 11b for preparing active or stand-by status; an input/output device 3 for inputting/outputting a signal to a plant; and I/O interface devices 2a and 2b having signal output decision parts 12a and 12b for deciding a signal to be output to the input/output device, and for switching it to another system. This digital controller is provided with an abnormal status detection device 4 having storage part 14 for storing a status signal and a status detection circuit 13 for detecting an abnormal state from the stored status signal; and a warning device 5 for displaying the detected abnormal state. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a digital control device that performs monitoring control of a plant.

  In a digital control device that performs plant monitoring control, there is a case in which a configuration in which CPUs are synchronously duplicated is taken in order to avoid a loss of function due to a failure of one CPU and to improve an operation rate. (For example, refer to Patent Document 1).

  Such synchronously duplicated CPUs receive the same input such as process values and perform the same control calculation processing while synchronizing with each other. Each CPU has a normal state or a standby state (hereinafter referred to as a status), and in a normal state, the normal CPU outputs operation result data to the input / output device via the I / O interface device, The CPU performs only calculations. When an abnormality occurs when the normal CPU loses its function, the standby CPU switches the output so that the function of the CPU is continued.

  Here, the principle of status creation and exchange of the CPU that is synchronized and duplicated will be described with reference to the conventional configuration diagram shown in FIG.

  In FIG. 7, CPU A 1a and CPU B 1b have a synchronous duplex configuration, and perform the same control processing in synchronization with each other.

  On the CPU A 1a, a duplex status creating circuit A 11a configured by a logic IC or the like is incorporated, and this duplex status creating circuit A 11a is a status (normal or standby) of its own CPU. And the normal or standby status signal A 101a is output.

  The output status signal A 101a is transmitted from the transmission unit 15 on the CPU A 1a to the other system CPU B 1b. On the CPU B 1b, the receiving unit 16 receives the status signal A 101a transmitted from the CPU A 1a. The status signal A 101a received by the CPU B 1b is input to the duplex status creating circuit B 11b on the CPU B 1b.

  At this time, a standby command signal B 102b which is a signal indicating an error of the self-diagnosis result is input to the duplex status creating circuit B 11b together with the status signal A 101a.

The duplex status creation circuit B 11b determines the status of its own CPU from these inputs and outputs a status signal B 101b. The output status signal B 101b is input to the duplex status creating circuit A 11a on the CPU A 1a via the transmitting element 15 on the CPU B 1b and the receiving element 16 on the CPU A 1a.
At this time, the duplex status creation circuit A 11a determines the status of the CPU of the own system (A system) by the standby command signal A 102a which is a failure signal indicating an error of the self-diagnosis result together with the status signal B 101b. To do.

  For example, when the standby command signal 102a is input to the duplex status creation circuit A 11a while the CPU A 1a is in the normal state and the CPU B 1b is in the standby state, the duplex status creation circuit A 11a The status signal A 101a to be switched is switched from “normal use” to “standby”. When the status signal A 101a switched to standby is input, the duplex status creation circuit B 11b on the standby CPU B 1b changes the output status signal B 101b from “standby” to “normal”. Switch. In this way, the statuses of both A and B dual CPUs are switched.

  Further, when the CPU of the own system is on standby and the CPU of the other system is in a normal state, when the CPU of the other system is switched to standby due to a standby command or a failure, the CPU of the own system is ”To“ Regular ”.

  A signal output determination unit A 12a is provided in the I / O interface device A 2a, and an output signal A 103a and a status signal A 101a are input from the CPU A 1a to the signal output determination unit A 12a. .

  When both signals are input, the signal output determination unit A 12a outputs the output signal A 103a as the output signal AA 103aa to the input / output device 3 when the status signal A 101a is normal. When 101a is on standby, output to the input / output device 3 is not performed.

  Similar control arithmetic processing and output processing are performed for the CPU B 1b system.

The input / output device 3 outputs an output signal (output signal AA 103aa or output signal BB 103bb) from the input regular I / O interface device (2a or 2b) to the outside as an output signal S 103s.
JP 2001-60160 A

  As described above, in the conventional digital control apparatus in which the CPUs have a synchronous duplex configuration, the statuses are mutually exchanged by the duplex status creation circuit on each CPU, and the normal or standby is determined, the status creation circuit There were the following problems related to the failure.

  First, due to a failure of the status creation circuit, the status of the CPU is switched unnecessarily, and the state of the CPU may become normal for both the A and B systems.

  As described above, when both the A and B systems are in regular use, an output signal is transmitted from the I / O interface apparatus of both the A and B systems to the input / output device. There has been a problem that hunting occurs in the output from the device, which adversely affects the control state.

  Next, in the conventional digital control device, each CPU has a self-diagnosis function and detects its own fault, but does not detect faults in the duplex status creation circuit and status transmission / reception circuit. . For this reason, even when a failure occurs, it is difficult to detect the failure, and there is a problem that recovery is delayed.

  The present invention has been made to solve the above-described problem, and in a CPU synchronous duplex configuration, it is possible to detect a failure of a CPU duplex status creation circuit and to identify a failure system and a failure location, It is an object of the present invention to obtain a digital control device having a function of preventing adverse effects on a control state such as output hunting due to a failure.

  The first digital control device of the present invention inputs a control processing unit in which the own system executes the same operation as the other system, a status signal of the other system indicating a normal or standby status, and a failure signal of the own system, In the status creation circuit that creates the status signal of the normal system or standby system, the signal transmission unit that transmits the status signal of the system created by the status creation circuit to the other system, and the status creation circuit of the other system A signal receiving unit for receiving a status signal that has been created and transmitted, a CPU that is duplicated in the own system and another system, and a signal input to the plant from each of the control processing units of the duplicated CPUs The output signal to the input / output device is determined by the status signal transmitted from the status generation circuit of the own system between the input / output device that performs output and each control processing unit and the input / output device. Alternatively, in a digital control device including an I / O interface device having a signal output determination unit for switching a standby status, both the own system and the other system created by the status creation circuits of each of the duplicated CPUs A status abnormality detection device having a storage unit for storing a status signal, and a status detection circuit for detecting an abnormal state of the status signal by comparing the stored status signals of the own system and the other system, and the detected status An alarm device for displaying an abnormal state of the signal is provided outside the dual CPU.

  The second digital control device of the present invention inputs a control processing unit that executes the same operation as the other system, a status signal of the other system indicating a status of normal or standby, and a failure signal of the own system, and uses the normal or standby The status creation circuit that creates the status of its own system, the signal transmission unit that sends the status signal created by the status creation circuit of its own system to the other system, and the status creation circuit of the other system that is created and transmitted A CPU having a signal receiving unit for receiving the status signal that has been duplicated, and a CPU that is duplicated into another system and an input / output unit that inputs and outputs signals from the control processing unit of the duplicated CPU to the plant A signal output to the input / output device is determined by the status signal transmitted from the status generation circuit of the own system between the device, the control processing unit of the own system and the other system, and the input / output device. In the digital control device including an I / O interface device having a signal output determination unit to be switched, each of the I / O interface devices exchanges a status signal of a regular or standby interface device, Comparison between the status monitoring unit that creates the status of the local I / O interface device based on the status signal transmitted and the status signal of the interface device transmitted from the other system I / O interface device, and the status monitoring unit And a signal output determination unit that determines a signal output to the input / output device and switches to another system based on the result.

  The third digital control device of the present invention inputs a control processing unit that executes the same operation as that of the other system, a status signal of the other system indicating the status of normal or standby, and a failure signal of the own system, and uses the normal or standby The status signal generated and transmitted by the three-circuit status generation circuit that creates the same status of the own system and transmits each status signal to the other system, and the status generation circuit of the other three circuits. The status created by the other system status selection circuit that selects the status of the other system and sends a status signal to the status creation circuit of the three systems of the own system and the status creation circuit of the three systems of the own system The local system having a local status selection circuit that receives a signal, selects the status of the local system, and transmits a status signal to the control processing unit of the local system, A CPU, an input / output device that inputs / outputs signals from the control processing unit of the duplicated CPU to the plant, and between the control processing unit of the own system and another system and the input / output device And an I / O interface device having a signal output determination unit that determines a signal output to the input / output device based on a status signal transmitted from the status selection circuit of the own system and switches to another system. To do.

The fourth digital control device of the present invention inputs a control processing unit that executes the same operation as that of the other system, a status signal of the other system indicating a status of normal use or standby, and a failure signal of the own system, and performs normal use or standby. The status creation circuit that creates the status of its own system, the signal transmission unit that sends the status signal created by the status creation circuit of its own system to the other system, and the status creation circuit of the other system that is created and transmitted In addition to the status signal of both the local system and the other system created by the signal receiving unit that receives the status signal generated, the status creation circuit, and the status of the local system A storage unit that stores the status signal of the other system that is input to the creation circuit and the status signal of the host system that is input to the status generation circuit of the other system, and six types of signals stored in the storage unit In comparison, a CPU having a status monitoring control circuit for identifying a fault location and a CPU that is duplicated in the own system and another system, and input / output of signals from the control processing unit of the duplicated CPU to the plant The signal to be output to the input / output device is determined by the status signal transmitted from the own status monitoring control circuit between the input / output device to be performed, the control processing unit of the own system and the other system, and the input / output device. And an I / O interface device having a signal output determination unit for switching to another system.

  According to the present invention, it is possible to detect a failure of the CPU duplication status creation circuit and identify a failure system and a failure location.

  Embodiments of a synchronous dual CPU according to the present invention will be described below with reference to the drawings.

(First embodiment)
First, a first embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing a first embodiment of the present invention. Elements having the same reference numerals as those in FIG. 7 showing a conventional example show the same parts.

  The feature of the present embodiment is that the status of each CPU in normal use or standby is monitored by the status failure detection device 4 on another controller, and when a normal state of both systems is detected, an alarm is displayed. By storing the status, it is possible to detect which system status circuit has undergone abnormal switching.

  The digital control device of the present embodiment includes a status failure detection device 4 in addition to the configuration of FIG. 7 showing the conventional example, and this status failure detection device 4 is a duplex status creation circuit A on the CPU A 1a. 11a is connected to the output part (not shown) of status signal A 101a and the output part (not shown) of status signal B 101b from duplex status creating circuit B 11b on CPU B 1b , A status detection circuit 13 that detects the status of both the A and B CPUs, and a storage unit 14 that stores the status detected by the status detection circuit 13.

  Further, the status detection circuit 13 is connected to the alarm device 5, and the alarm device 5 outputs an alarm when receiving the failure information 104 detected by the status detection circuit 13.

The operation of these components will be described below.
First, the status detection circuit 13 on the status failure detection device 4 outputs the status signal 101a of the CPU A 1a and the status signal 101b of the CPU B 1b to the status signal output portions (shown in the figure) of the duplex status creation circuits 11a and 11b. Not) and record in the storage unit 14.

  Next, when the status detection circuit 13 detects the normal status in both the A and B systems, the status information recorded in the storage unit 14 is compared, and the CPU of either system is switched from standby to normal. It is specified whether or not the information has been changed, and information on the changed system is output to the alarm device 5 as failure information 104.

  According to the present embodiment, when the status creation circuit of the synchronous dual CPU or the transmission / reception element of the status signal breaks down and the both systems are in normal use, the status failure detection device uses the status in both systems and the normal use. By detecting the system switched to, and outputting the failure information to the alarm device, the failure can be detected at an early stage and recovered.

(Second Embodiment)
A second embodiment will be described with reference to FIG. FIG. 2 is a block diagram showing a second embodiment of the present invention. Elements having the same reference numerals as those in FIG. 1 showing the first embodiment show the same parts.

  The feature of the present embodiment is that the status detection circuit 13 of the first embodiment has a status signal A before passing through the transmitter 15 of the duplex status creation circuit A and duplex status creation circuit B of its own system. 101a, status B 101b, status system B of the other system that receives them, status signals 101a and 101b after passing through the receiving unit 16 of status generation circuit A, and standby command signals 102a and 102b of both systems 6 By monitoring the types of signals, the failure location can be detected not only when the status creation circuit itself fails, but also when the failure occurs in the transmission / reception unit and the status changes.

  In the present embodiment, in addition to the configuration of FIG. 1 showing the first embodiment, the status detection circuit 13 on the status failure detection device 4 has a standby command signal A 102a to the duplex status creation circuit A 11a. The input part of the branch of the status signal B 101b to the duplex status creation circuit A 11a and the input of the branch of the standby command signal B 102b to the duplex status creation circuit B 11b Part and an input part corresponding to a branch of the status signal A 101a to the duplex status creating circuit B 11b, and the above six types of signals are taken in. Other configurations are the same as those in FIG. 1 in the first embodiment.

The operation of the above constituent elements will be described below.
First, as described above, the status detection circuit 13 on the status failure detection device 4 is a branching part of the standby command signal 102a input from the CPU A 1a itself to the duplex status creation circuit A 11a on the CPU A 1a. And a branch of the status signal B 101b which is transmitted from the transmitting unit 15 on the CPU B 1b and received by the receiving unit 16 on the CPU A 1a and input to the duplex status creating circuit A 11a, and 2 The state (branch) before being input from the transmission unit 15 of the status signal A 101a output from the duplication status creation circuit A 11a to the duplication status creation circuit B 11b is captured.

  In addition to this, the status detection circuit 13 on the status failure detection device 4 includes a branch of the standby command signal 102b input from the CPU B 1b itself to the duplex status creation circuit B 11b on the CPU B 1b, and the CPU. A branch of the status signal A 101a that is transmitted from the transmitting unit 15 on A 1a and received by the receiving unit 16 on CPU B 1b and then input to the duplex status creating circuit B 11b, and the duplex status The status (Branch) before being input from the transmission unit 15 of the status signal B 101b output from the generation circuit B 11b to the duplex status generation circuit A 11a is captured.

  Next, the status detection circuit 13 that has fetched the above six types of signals records the state of each signal (status and standby command) in the storage unit 14, and when the state of each signal is switched, the storage unit 14. Based on the status and standby command information recorded in (1), the soundness of switching is determined as described later.

  When the abnormality is detected, the status detection circuit 13 outputs information regarding the abnormality status and information regarding the failure location to the alarm device 5 as the failure information 104. Other operations are the same as those in the first embodiment.

  In determining the soundness of the switching, as described below, when the status creation circuit of the synchronous dual CPU or the status signal transmission / reception unit fails, the status switching pattern differs depending on the failure location. Take advantage of that.

  First, as a first case, (1-1) failure of a status signal transmission unit of a normal (eg, A system) CPU, (1-2) failure of a status signal reception unit of a standby (B system) CPU , (1-3) If any of the failures in the redundant status creation circuit of the standby (B system) CPU occurs, in either case, the standby (B system) CPU is duplicated. The status signal output from the control status generation circuit is switched to normal use, and both the A and B CPUs are in normal use.

  Among these, in the case of a failure in the (1-3) standby (B system) CPU duplex status creation circuit, the normal (B system) duplex status creation circuit input to the standby (B system) Even if the status signal of the A system is not switched to standby, the status signal is switched from “standby” to “normal use”.

  In addition, when the transmitter / receiver of (1-1), (1-2) is out of order, the status signal immediately after output from the normal (A system) duplex status creating circuit remains in normal use. As a result of the status signal being switched to standby at the stage where it is input to the duplex status creation circuit of the standby (B system) CPU, the status signal to be output is switched from “standby” to “normal”.

  Accordingly, when the status detection circuit 13 monitors immediately after the output of the status signals of both the A and B systems from the duplex status creation circuits 11a and 11b and detects that both systems are in normal use, First, from the status information recorded in the storage unit, it is confirmed which system status has been switched from “standby” to “normal”, and if the switching is confirmed, the cause of both systems is (1 If the switching status creation circuit of the standby CPU in (-3) fails, and switching is not confirmed, the failure of the status signal transmission unit of (1-1) the normal CPU or (1-3) standby system It is possible to specify whether the status signal receiving unit of the CPU is faulty.

  Next, as a second case, (2-1) in the case of a failure of a normal (for example, A system) duplex status creation circuit, a standby B system is output from a normal A system CPU. The status signal input to the duplex status creation circuit is switched from “normal” to “standby”, and the status signal output from the standby B system duplex status creation circuit is changed from “standby” to “standby”. Switch to "Common use".

  In this case, monitoring only the status signal immediately after output from the duplex status creation circuit of both A and B systems distinguishes it from “normal status switching” by inputting a standby command to the regular CPU. I can't.

  Therefore, when the status detection circuit 13 detects the switching of the normal or standby status, whether or not the standby command signal is input to the normal CPU based on the status information recorded in the storage unit. If the status is switched in spite of the standby command not being input, it can be identified as a failure of the normal duplex status creation circuit.

  Next, as a third case, (3-1) a failure of a status signal transmission unit of a standby (eg, B system) CPU, (3-2) a status signal reception unit of a normal (A system) CPU, When one of the failures occurs, the status signal at the stage output from the duplicated status creation circuit of the standby (B system) CPU remains in standby, but the normal (A system) (Ii) At the stage of input to the duplex status creation circuit, switching from standby to normal use is made.

  In this case, the normal (A system) duplex status creation circuit does not switch the status of the own system from normal to standby, so that status switching does not occur and the standby command and failure do not occur. Indistinguishable.

  Therefore, the status detection circuit 13 monitors the statuses of both the A and B systems, and even when there is no change in status, the status information recorded in the storage unit is input to the normal duplex status creation circuit. If the status signal of the standby system is switched from standby to normal use, if it is switched, (3-1) failure of status signal transmission unit of standby CPU or (3-2) normal use It can be identified as a failure of the status signal receiving unit of the CPU.

  According to the form of this embodiment, as a result of the failure of the status creation circuit or status signal transmission / reception unit of the synchronous dual CPU, (1) the status becomes normal for both the A and B systems; When both the A and B systems are switched, (3) the status detection circuit 13 can detect a failure regardless of whether the statuses of both the A and B systems are unchanged. As for the location, in the case of a redundant status creation circuit failure, which system is the synchronous dual CPU A or B, and in the case of a status signal transmission / reception unit failure, the synchronous dual CPU It is possible to detect which of the status signals A and B is the transmitting unit or the receiving unit.

  Further, by outputting information on status abnormality and failure to the alarm device as failure information, it becomes possible to detect the failure at an early stage and perform recovery.

(Third embodiment)
A third embodiment will be described with reference to FIG. FIG. 3 is a block diagram showing a third embodiment of the present invention. Elements having the same reference numerals as those in FIG. 2 showing the second embodiment indicate the same parts.

  In addition to the status detection circuit of the second embodiment, the feature of the present embodiment is that the status signal transmission unit and the reception unit rear are indicated by LEDs so that the status detection circuit can detect a failure of the transmission / reception unit. When it is specified that there is a failure, it is possible to specify whether the failure is in the transmission unit or the reception unit.

  In this embodiment, in the configuration of FIG. 2 showing the second embodiment, the status signal transmitting unit and the receiving unit of both A and B systems, and the duplex status creating circuit of both A and B systems are used. An LED 17 that is turned on, turned off, turned off, or turned on in response to a normal or standby status is connected between a status signal input unit (not shown) and a receiving unit. Other configurations are the same as those in FIG. 2 in the second embodiment.

  Looking at its action, the LED 17 after the status signal transmission unit 15 on the CPU A 1a is turned on or off in accordance with the state after the transmission unit of the status signal A 101a output from the duplex status creation circuit A 11a. The LED 17 after the status signal receiving unit 16 on the CPU B 1b is turned on or off according to the state after the receiving unit of the status signal A 101a.

  Similarly, the LED is turned on or off with respect to the status signal of the CPU B 1b. Other operations are the same as those of the second embodiment.

  As described above, the effect of the second embodiment is that, even if a failure occurs in the status signal transmission / reception unit of the synchronous dual CPU, the status detection circuit relates to which status signal of the synchronous dual CPU. It is possible to identify the failure of the transmission unit or the reception unit and obtain the failure information by the alarm device.

  Therefore, after specifying which status signal of the synchronous duplex CPU is a failure of the transmission unit or the reception unit, between the transmission unit and the reception unit, and the status signal input unit of the duplex status creation circuit If the status specified by the lighting state is the same by looking at the lighting state of the LED connected between the receiver and the receiver unit, the transmitter unit fails. It can be specified to be.

  According to the present embodiment, as in the second embodiment, after the failure information identifies that the status signal transmission unit or reception unit of the synchronous dual CPU has failed, In the control device provided, it is possible to specify whether the failure is in the transmitter or the receiver by the lighting state of the LED attached to the CPU board.

(Fourth embodiment)
A fourth embodiment will be described with reference to FIG. FIG. 4 is a block diagram showing a fourth embodiment of the present invention. Elements having the same reference numerals as those in FIG. 7 showing the conventional example show the same parts.

  The feature of this embodiment is that, in the configuration of CPU-I / O interface-input / output, an interface (hereinafter referred to as I / F) board has a duplex switching status, and a status switching command is received from the host CPU. In this case, the status of the other system interface is monitored and the switching system is blocked.

  The configuration diagram of FIG. 4 includes a status monitoring unit A 18a on the I / O interface device A 2a in addition to the configuration example of the conventional example. A status monitoring unit B 18b is also provided on the I / O interface device B 2b. Other configurations are the same as those in FIG. The operation is as follows.

  First, the output signal A 103a from the control processing unit A 20a and the status signal A 101a from the duplex status creation circuit A 11a are input to the signal output determination unit A 12a on the I / O interface device A 2a. The

  At this time, if the status signal A 101a is “normal”, the signal output determination unit A 12a outputs the output signal A 103a as the output signal AA 103aa to the input / output device 3, but the status signal A 101a is “standby”. ", The output to the input / output device 3 is not performed.

  Next, the status monitoring unit A 18a outputs a status signal A 101a output from the duplex status generation circuit A 11a on the CPU A 1a and an I / F device status signal B 106b output from the I / O interface device B 2b. And monitor the status of both A and B systems. The status monitoring unit A 18a determines the status of the I / O interface device A 2a based on the monitoring data, and monitors the status monitoring on the I / O interface device B 2b using the determined I / F device status signal A 106a. Output to part B 18b. Further, an output OFF command A 105a is transmitted to the signal output determination unit A 12a on the I / O interface device A 2a.

  That is, when the statuses of the CPU A 1a and the I / O interface device A 2a are switched from “normal” to “standby” by a standby command or the like, the status monitoring unit A 18a displays the status signal A 101a “ Confirm the switching from “normal” to “standby” and the “standby” state of the I / F device status signal B 106b, switch the I / F device status signal A 106a from “normal” to “standby”, The data is transmitted to the status monitoring unit B 18b on the I / O interface device B 2b. Further, an output OFF command A 105a is transmitted to the signal output determination unit A 12a on the I / O interface device A 2a.

  After that, the status monitoring unit B 18b on the I / O interface device B 2b switches the status signal B 101b that is input from “standby” to “normal”, and the I / F status signal A 106a “ After confirming switching from “normal” to “standby”, the I / F device status signal B 106b is switched from “standby” to “normal” to the status monitoring unit A 18a on the I / O interface device A 2a. Send.

  On the other hand, when the statuses of the CPU A 1a and the I / O interface device A 2a are switched from the “standby” state to the “normal use”, for example, due to a failure in the status creation circuit of the CPU or the status signal transmission / reception unit, When the status signal A 101a output from the creating circuit A 11a is switched from the “standby” state to the “normal use”, the status monitoring unit A 18a detects the switching.

  However, since the CPU B 1b and the I / O interface device B 2b remain “normal” and the I / F device status signal B 106b is “normal”, the I / F created by the status monitoring unit 18a The F device status signal A 106a is maintained as “standby”.

  At this time, when the status monitoring unit A 18a on the I / O interface device A 2a transmits the output OFF command A 105a to the signal output determination unit 12a, the status signal A 101a is switched from “standby” to “normal use”. As a result, the effect that the output signal AA 103aa is output from the signal output determination unit 12a to the input / output device 3 is avoided.

  The I / O interface device B 2b has the same operation. Other operations are the same as in the conventional example.

  According to the present embodiment, the status for creating the status of the I / O interface device even when both the A and B systems become “normal” due to the failure of the status creation circuit of the synchronous dual CPU or the transmitting / receiving element. When the monitoring unit monitors the status of the CPU and the status of the other system I / O interface device and detects that both systems A and B are “normal”, the status of the I / O interface device is not updated. Thus, it is possible to prevent the output signals of both the A and B systems from being transmitted to the input / output device, and to prevent the control state from being adversely affected by output hunting or the like.

(Fifth embodiment)
Next, a fifth embodiment will be described with reference to FIG. FIG. 5 is a block diagram showing a fifth embodiment of the present invention. Elements having the same reference numerals as those in FIG. 7 showing the conventional example show the same parts.

  The feature of this embodiment is that the duplex status creating circuit is tripled and a status selection circuit is provided on the counterpart CPU side to prevent abnormal system switching when the status switching circuit fails.

  In addition to the configuration of FIG. 7 showing the conventional example, the digital control device according to the present embodiment includes a duplex status creation circuit AA 11aa and duplex as three duplex status creation circuits on the CPU A 1a. A status creation circuit AB 11ab and a duplex status creation circuit AC 11ac are provided, and a duplex status creation circuit BA 11ba and a duplex status creation circuit are provided as three duplex status creation circuits on the CPU B 1b. BB 11bb and duplex status creation circuit BC 11bc are provided.

  Here, the standby command signal A 102a is input to all three duplex status generation circuits on the CPU A 1a, and the standby command signal B 102b is input to the three duplex signals on the CPU B 1b. Input to all status creation circuits.

  Further, another system status selection circuit A 19a is provided on the CPU A 1a.

  The other-system status selection circuit A 19a is connected to all three duplex status creation circuits on the CPU B 1b and outputs a status signal BA 101ba and duplex status output from the duplex status creation circuit BA 11ba. The status of the CPU A 1a is determined from the status of the status signal BC 101bb output from the creation circuit BB 11bb and the status signal BC 101bc output from the duplex status creation circuit BC 11bc by majority logic or the like, and the status of the other system The status signal AS 101as of the selected other system (A system) is transmitted to the three duplex status creation circuits 11ba, 11bb, 11bc on the CPU B 1b via the selection circuit B 19b.

  On the CPU A 1a, a self-system (A-system) status signal selection circuit A 21a is provided. The status signal selection circuit A 21a is connected to all of the above three status generation circuits of its own system, determines the status of the CPU A 1a by majority logic from the transmitted status signals, and performs control processing on the CPU A 1a. The selected own system status signal 101at is transmitted to the signal output determination unit A 12a on the unit A 20a and the I / O interface device A 2a.

  The CPU B 1b is also provided with a local status selection circuit B 21b having the same function. Other configurations are the same as those in FIG. 7 showing the conventional example. The operation is as follows.

  The three duplex status creation circuits on the CPU A 1a independently create the status of the CPU A 1a and transmit a status signal to the CPU B 1b.

  On the CPU B 1b, the three status signals of the CPU A 1a are independently input to the status selection circuit B 19b of the other system. The status selection circuit B 19b of the other system determines the status of the CPU A 1a by majority logic or the like, and outputs the determined status signal AS 101as. The output status signal AS 101as is input to each of the three duplex status creation circuits on the CPU B 1b.

  The other system status selection circuit B 19b on the CPU B 1b performs the same operation.

  In addition, the above three self-system (B system) duplex status signals are independently input to the self-system status selection circuit A 21a on the CPU A 1a. Determine the status.

  The determined status signal AT 101at of the own system is output from the own system status selection circuit A 21a and is input to the control processing unit A 20a and the signal output determination unit A 12a.

  The control processing unit A 20a performs control arithmetic processing using the status signal AT 101at, and outputs the output signal A 103a to the signal output determination unit A 12a.

  When the output signal A 103a and the status signal AT 101at are input to the signal output determination unit A 12a and the status signal AT 101at is “ordinary”, the output signal A 103a is sent to the input / output device 3 and the output signal AA 103aa. However, when the status signal AT 101 at is “standby”, the output to the input / output device 3 is not performed.

  The own system status selection circuit B 21b on the CPU B 1b performs the same operation. Other operations are the same as in the conventional example.

  According to the present embodiment, in the synchronous duplex CPU, three duplex status creation circuits are provided on each CPU, and the three transmitted status signals are sent to the own system status selection circuit of the own CPU. The other CPU status is selected by another system status selection circuit, and the status is determined using majority logic or the like.

  As a result, abnormal status switching due to a single failure in the duplex status creation circuit or status signal transmitter / receiver, control processing using the abnormal status, transmission of both system output signals to the input / output device due to the abnormal status, etc. Thus, it is possible to prevent the control state from being adversely affected by output hunting or the like.

(Sixth embodiment)
Next, a sixth embodiment will be described with reference to FIG. FIG. 6 is a block diagram showing a sixth embodiment of the present invention. Elements having the same reference numerals as those in FIG. 7 showing the conventional example show the same parts.

  The feature of the present embodiment is that a monitoring circuit is provided for the status exchange circuit in the duplex CPU, thereby monitoring the standby command, the own system status, and the other system status, and sending the monitored signal to the control processing unit. It is used to avoid the influence on the control due to normal use of both systems or failure side use.

  The digital control apparatus according to the present embodiment includes a status monitoring control circuit A 22a and a storage unit A 14a on the CPU A 1a in addition to the configuration of the conventional example shown in FIG.

  The status monitoring control circuit A 22a outputs the status signal A 101a from the duplex status creation circuit A 11a on the CPU A 1a, and the status signal B 101b from the duplex status creation circuit B 11b on the CPU B 1b. Output unit of the standby status signal B 102b to the duplex status generation circuit B 11b and the input unit of the standby command signal A 102a to the duplex status generation circuit A 11a and the input unit of the status signal B 101b Connected to the input of status signal A 101a, the status of each signal is captured.

  When the status monitoring control circuit A 22a monitors the statuses of both the A and B CPUs and detects an abnormal status, the status monitoring control circuit A 22a notifies the control processing unit A 20a and the signal output determination unit 12a to the own system status before the abnormal switching. Is output as the status signal AU 101au.

  The storage unit A 14a records the signal state of each unit captured by the status monitoring control circuit A 22a.

Similarly, a status monitoring control circuit B 22b and a storage unit B 14b are provided on the CPU B 1b. Other configurations are the same as those in FIG. 7 showing the conventional example.

  Similar to the status detection circuit 13 in the second embodiment, the status monitoring control circuit A 22a on the CPU A 1a, which has captured six types of signals, stores the status of each signal (status or command) in the storage unit A 14a. When the state is switched, the soundness of switching is determined from the status and standby command information recorded in the storage unit 14.

  As a result, when the status abnormality is detected, the own system status before the abnormality switching is transmitted to the control processing unit A 20a and the signal output determination unit 12a as the status signal AU 101au.

  The control processing unit A 20a performs control arithmetic processing using the status signal AU 101au, and outputs the output signal A 103a to the signal output determination unit A 12a.

  The signal output determination unit A 12a receives the output signal A 103a and the status signal AU 101au.

  If the status signal AU 101au is “normal”, the output signal A 103a is output as the output signal AA 103aa to the input / output device 3, but if the status signal AU 101au is “standby”, the input / output No output to device 3 is made.

  The status monitoring control circuit B 22b on the CPU B 1b performs the same operation. Other operations are the same as in the conventional example.

  According to the present embodiment, even if the status is abnormally switched due to the failure of the status creation circuit of the synchronous dual CPU or the transmission / reception element of the status signal, the status in the CPU is monitored Control processing using an abnormal status, that is, an abnormality, by detecting an abnormality by the control circuit and the storage unit and not updating the own system status used by the control processing unit in the CPU or the signal output determination unit in the I / O interface device It is possible to prevent both A and B system output signals from being transmitted to the input / output device due to status, and to prevent adverse effects on the control state due to output hunting or the like.

The block diagram which shows the digital control apparatus of the 1st Embodiment of this invention. The block diagram which shows the digital control apparatus of the 2nd Embodiment of this invention. The block diagram which shows the digital control apparatus of the 3rd Embodiment of this invention. The block diagram which shows the digital control apparatus of the 4th Embodiment of this invention. The block diagram which shows the digital control apparatus of the 5th Embodiment of this invention. The block diagram which shows the digital control apparatus of the 6th Embodiment of this invention. The block diagram which shows the digital control apparatus using the conventional synchronous duplication CPU.

Explanation of symbols

  1a ... CPU A, 1b ... CPU B, 2a ... I / O interface device A, 2b ... I / O interface device B, 3 ... input / output device, 4 ... status abnormality detection device, 5 ... alarm device, 11a ... double Duplicate status creation circuit A, 11b ... Duplex status creation circuit B, 11aa ... Duplex status creation circuit AA, 11ab ... Duplex status creation circuit AB, 11ac ... Duplex status creation circuit AC, 11ba ... Duplex Status generation circuit BA, 11bb ... Duplex status creation circuit BB, 11bc ... Duplex status creation circuit BC, 12a ... Signal output determination unit A, 12b ... Signal output determination unit B, 13 ... Status detection circuit, 14 ... Storage unit, 14a ... Storage unit A, 14b ... Storage unit B, 15 ... Transmission unit, 16 ... Reception unit, 17 ... LED, 18a ... Status monitoring unit A, 18b ... Status monitoring unit B, 19a ... Other system status selection circuit A, 19b ... Other system status selection circuit B, 20a ... Control processing unit A, 20b ... Control processing unit B, 21a ... Local system status selection Circuit A, 21b ... Own system status selection circuit B, 22a ... Status monitoring control circuit A, 22b ... Status monitoring control circuit B, 101a ... Status signal A, 101aa ... Status signal AA, 101ab ... Status signal AB, 101ac ... Status signal AC, 101as ... Status signal AS, 101at ... Status signal AT, 101au ... Status signal AU, 101b ... Status signal B, 101ba ... Status signal BA, 101bb ... Status signal BB, 101bc ... Status signal BC, 101bs ... Stay Status signal BS, 101bt ... Status signal BT, 101bu ... Status signal BU, 102a ... Standby command signal A, 102b ... Standby command signal B, 103a ... Output signal A, 103aa ... Output signal AA, 103b ... Output signal B, 103bb ... Output signal BA, 103s ... Output signal S, 104 ... Fault information, 105a ... Output OFF command A, 105b ... Output OFF command B, 106a ... I / F device status signal A, 106b ... I / F device status signal B.

Claims (6)

A control processing unit in which the own system performs the same operation as the other system;
A status creation circuit that creates a status signal of the normal system or standby system by inputting the status signal of the other system indicating the status of normal use or standby and a failure signal of the local system,
A signal transmission unit for transmitting the status signal of the own system created by the status creation circuit to another system;
A CPU having a signal receiving unit for receiving a status signal of another system created and transmitted by a status creation circuit of another system and a CPU duplicated in the other system;
An input / output device for inputting / outputting a signal from each control processing unit of the duplicated CPU to the plant;
A signal output to the input / output device is determined by a status signal transmitted from the own status generation circuit between each control processing unit and the input / output device, and a status of normal use or standby is determined. In a digital control device including an I / O interface device having a signal output determination unit for switching,
The storage unit for storing status signals of both the own system and the other system created by the status creation circuits of each of the duplicated CPUs is compared with the stored status signals of both the own system and the other system. A status abnormality detection device having a status detection circuit for detecting an abnormal state of the status signal;
A digital control device comprising: an alarm device for displaying an abnormal state of the detected status signal. In addition to the status signals of both the own system and the other system created by the status creation circuits of each of the duplicated CPUs, the storage unit in the status abnormality detection device includes the internal system of each of the own system and the other system. 6 types of signals are stored: a signal indicating a failure, a status signal of the other system before being transmitted to the status creating circuit of the own system, and a status signal of the own system before being transmitted to the status creating circuit of the other system;
2. The digital control device according to claim 1, wherein the status detection circuit in the status abnormality detection device identifies the failure location by comparing the six types of signals stored in the storage unit.   Among the six types of signals, the status signal of the other system transmitted from the signal transmission unit of the other system to the signal receiving unit of the own system, the status signal of the own system input to the signal receiving unit of the own system, Display the status of four types of signals, the status signal of the own system transmitted from the signal transmission unit of the system to the signal reception unit of the other system, and the status signal of the other system input to the signal reception unit of the other system, The digital control device according to claim 2, further comprising an LED display device that specifies that the failure point is a signal transmission unit or a signal reception unit of the own system or another system. A control processing unit in which the own system performs the same operation as the other system;
A status creation circuit that creates a status signal of the normal system or standby system by inputting the status signal of the other system indicating the status of normal use or standby and a failure signal of the local system,
A signal transmission unit for transmitting the status signal of the own system created by the status creation circuit to another system;
A CPU having a signal receiving unit that receives a status signal generated and transmitted by a status generation circuit of another system and a CPU that is duplicated in the other system;
An input / output device for inputting / outputting a signal from each control processing unit of the duplicated CPU to the plant;
A signal output to the input / output device is determined between the control processing unit and the input / output device based on a status signal transmitted from the status generation circuit of the own system. In a digital control device including an I / O interface device having a signal output determination unit for switching,
Each of the I / O interface devices exchanges a status signal of a normal or standby interface device, and the status signal transmitted from its own CPU and the interface device transmitted from another I / O interface device A status monitoring unit that creates the status of the local I / O interface device based on the status signal of
A digital control device comprising: a signal output determination unit that determines a signal to be output to the input / output device based on a comparison result in the status monitoring unit and switches a status of normal use or standby. A control processing unit in which the own system performs the same operation as the other system;
Three status creation circuits for inputting the status signal of the other system indicating the status of normal use or standby and the failure signal of the own system, creating the status of normal use or standby of the own system, and transmitting the status signal to the other system; ,
The status of the other system is selected from the three status signals generated and transmitted by the three status generating circuits of the other system, and the selected status signal is sent to the three status generating circuits of the own system. Another system status selection circuit to transmit,
The status signal of the own system is selected from the three status signals of the own system created by the three status creation circuits of the own system, and the selected status signal is transmitted to the control processing unit of the own system. Own system status selection circuit,
A CPU that is duplicated in its own system and another system having
An input / output device for inputting / outputting signals from the control processing unit of the duplicated CPU to the plant;
A signal to be output to the input / output device is determined by the status signal transmitted from the status selection circuit of the own system between the control processing unit of the own system and the other system and the input / output device. A digital control device comprising: an I / O interface device having a signal output determination unit for switching the status of the device. A control processing unit in which the own system performs the same operation as the other system;
A status creation circuit for creating a status of the local system for normal use or standby by inputting a status signal of the other system indicating the status of normal use or standby and a fault signal of the local system,
A status signal created by the status creation circuit of the own system, a signal transmission unit that transmits to another system,
A signal receiving unit that receives a status signal created and transmitted by a status creation circuit of another system;
In addition to the status signals of both the own system and other systems created by the status creation circuit, a signal indicating a failure of both the own system and the other system, the status signal of the other system input to the status creation circuit of the own system, and A storage unit for storing six types of signals of the status signal of the own system to be input to the status creation circuit of another system;
A CPU that has a status monitoring control circuit that compares the six types of signals stored in the storage unit and identifies a failure location, and a CPU that is duplicated in another system;
An input / output device for inputting / outputting signals from the control processing unit of the duplicated CPU to the plant;
A signal to be output to the input / output device is determined based on the status signal transmitted from the status monitoring control circuit of the own system between the control processing unit of the own system and the other system and the input / output device. A digital control device comprising: an I / O interface device having a signal output determination unit for switching a standby status.

Images