JP2012027805A - Control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control system capable of continuing a plant control by a duplex control which can change over an execution right to a standby-system controller if only the standby-system controller is normal.SOLUTION: This control system includes the duplex system having an execution-system controller and the standby-system controller in an instrumentation system which controls production processes of production facilities. This control system includes a power supply element which supplies a power to an equalizing controller of the execution-system controller, a detection circuit for detecting abnormality of the power supply element, and a duplex control circuit, when the detection circuit detects abnormality of the power supply element, transmitting a changeover request to transfer the execution right from the execution-system controller to the standby-system controller, to the standby-system controller.

Description

  The present invention relates to an instrumentation system that controls a production process in a production facility such as an oil refinery plant, a petrochemical plant, a power generation plant, and an environmental treatment plant, and more particularly to a control system having an execution system controller and a standby system controller.

  In production facilities such as an oil refinery plant, a petrochemical plant, a power generation plant, and an environmental treatment plant, an instrumentation system that controls the production process needs to be stable and highly operated. For example, a garbage incineration plant among environmental treatment plants will be described below. FIG. 1 is a configuration diagram showing a main configuration of a waste incineration plant, and FIG. 2 is a configuration diagram showing a main configuration of an instrumentation system of the waste incineration plant. In the waste incineration plant, waste is thrown into the incinerator 102 from the waste pit 101, the combustion air in the furnace is measured by the thermal flow meter 103, and the liquid measurement of the waste sewage spray reused water in the incinerator 102 is performed by the flow meter 104. The waste is incinerated, and valuables and heat are recovered. The instrumentation system 203 includes a control controller 204 for controlling measuring instruments such as an ultrasonic level meter 205, a thermal flow meter 103, and a flow meter 104 used in the production process of the waste incineration plant. The controller 204 is connected to the console 201 via a network line 202 such as Ethernet (Ethernet is a registered trademark), and manages and controls the production process of the plant. For this reason, in order to configure an instrumentation system that is stable and highly operational as described above, the control controller 204 needs to be highly reliable. As a high-reliability method for the control controller 204, a duplex system including a standby system controller is widely used in addition to the execution system controller.

  As a method of configuring a duplex system for the high reliability method of the control controller 204, in order to enable hot standby of the standby system controller, in general, the reliability of the control information of the plant in the main memory of the execution system controller, etc. Data that needs to be transferred (hereinafter referred to as equalize data) is continuously transferred from the execution system controller to the standby system controller, and it is checked whether the equalization data between the systems match, and that the duplex control is correct. A memory transfer method has been proposed (see, for example, Patent Document 1).

  In order to improve the reliability in this memory transfer system, for example, in Patent Document 1, an automatic correction function of ECC 1 bit error and detection of a plurality of bit errors are performed in the main memory. By switching the execution right to the controller, a highly reliable control controller is provided, thereby realizing stable operation of the plant in the redundant system.

  In addition, the execution system controller that has detected a multi-bit error switches the execution right to the standby system controller, performs a main memory diagnostic test, and if there is no problem, continues to operate as the standby system controller. There is no problem in hardware, and a function of repairing a multi-bit error caused by a transient disturbance such as noise is provided. In this way, in the function to identify the error factor when a multi-bit error occurs, if there is no abnormality in the control controller, there is no work and cost of replacing the control controller, so a duplex system with excellent maintainability is provided is doing.

  In this way, when an abnormality occurs in the execution system controller, according to the conventional technology, the reliability of the equalized data and the occurrence of a multi-bit error are detected in the duplex control switching system that detects the abnormality and switches the execution right to the standby system controller. The noise tolerance enhancement at the time is taken into consideration, but the abnormal factor caused by the accidental failure of the power generation element mounted on the execution system controller is not taken into consideration.

  FIG. 3 is a block diagram for explaining the configuration of FIG. 2 in more detail. The control controller 204 includes an execution system controller 302 and a standby system controller 303 in a duplex system. In addition, measuring devices such as the ultrasonic level meter 205, the thermal flow meter 103, and the flow meter 104 are illustrated as a plurality of plant control measuring devices 313 in FIG. The duplex system is, for example, a duplex system having an execution system controller 302 and a standby system controller 303 connected by an operation console 201 and an Ethernet line 301 as shown in FIG. 3, and each controller has a CPU (Central Processing Unit) 306, It has an Ethernet controller 304, an equalize controller 305, a main storage unit 307, a duplex control circuit 308, an external bus 311 and an I / O (Input / Output) bus 312 connected to the CPU 306, and is connected to the I / O bus 312 by the CPU 306. The plant control measuring device 313 is controlled. Normally, a plurality of plant control measurement devices 313 are controlled by the execution system controller 302, and plant control information is managed and controlled by the console 201 via the Ethernet line 301 from the Ethernet controller 304. On the other hand, in order to enable hot standby of the standby system controller 303, the equalized data in the main storage unit 307 of the execution system controller 302 is continuously transferred to the standby system controller 303 by the equalization controller 305. Duplex switching is controlled by detecting a power failure due to an abnormality in the CPU 306 or power failure, and outputting a duplication control signal execution right switching request from the duplex control circuit 308 to the standby controller 303.

  In general, in a system that requires duplication of the controller, the main memory 307 is backed up in the event of a power failure, and the power supplied to the main memory 307 is different from that of the CPU 306, the equalizing controller 305, and the like. Need to be. Therefore, the first power generation element 309 that generates the first power to be supplied to the CPU 306, the equalization controller 305, and the like and the second power generation element 310 that generates the second power that is the power supply to the main storage unit 307 are configured. Has been.

  FIG. 4 is a time chart of the execution system controller and the standby system controller. An abnormality factor that occurs due to an accidental failure of the first power generation element 309 mounted on the execution system controller 302 will be described with reference to FIG. The first power generation element that generates the first power may become an overvoltage with time due to an accidental failure. At the first time 401 when an abnormality occurs, the first power supply is still at a normal voltage, so the CPU and the equalization controller of the execution system controller are operating normally. At the second time 402, the CPU of the execution system controller is still operating normally, and no abnormality is detected, so no execution right switching request is made to the standby system controller. However, at the second time 402, the equalizing controller of the execution system controller becomes abnormal and the equalizing data cannot be sent to the equalizing controller of the standby system controller. On the other hand, when the equalization data reception is stopped and the equalization monitoring timer is activated and the timer expires, the standby controller detects an equalization data reception error, and the standby controller's duplex control circuit determines that it is abnormal. Thereafter, even if there is an execution right switching request from the execution system controller, the operation is performed so as to reject the switching. At the third time 403 when more time has elapsed from the occurrence of the abnormality, the CPU of the execution system controller becomes abnormal, and the duplication control circuit of the execution system controller detects its own abnormality and issues an execution right switching request to the standby system controller. As described above, since the standby system controller has already detected its own abnormality at the second time 402, the CPU, the Ethernet controller, the main storage unit, and the supply to them are necessary for stable control of the plant control measurement equipment. Even though the power generation element to be executed is normal, the execution right is not switched normally. Therefore, even if there is an accidental failure of the power generation element of the active controller, the redundant control can switch the execution right to the standby controller if the standby controller is normal without being affected by the standby controller A circuit is required. Thus, there is a problem that the plant stops even though the plant control can be continued only by warning the abnormality.

JP 2008-146239 A

  As described above, in order to increase the reliability of the control controller that controls the production process of the production facility, the conventional dual control switching method that switches the execution right in the dual system with the execution system controller and standby system controller Then, in the event of an accidental failure of an element that generates power to be supplied to the CPU or equalizer controller of the execution system controller, the CPU, Ethernet controller, main memory unit, etc. necessary for stable control of the measurement equipment for plant control Although the power generation element and the like supplied to the device are normal, the execution right cannot be switched from the active system to the standby system. As a result, there is a problem that the plant stops even though the plant control can be continued only by warning the abnormality.

  The object of the present invention is to switch the execution right to the standby controller if the standby controller is normal without being affected by the standby controller even if the power generation element of the active controller is accidentally broken. It is to provide a control system capable of continuing plant control by constructing a dual control switching method that can be performed.

  In order to solve the above-described problems, an embodiment of the present invention provides an equalization of an execution system controller in a control system including a redundant system having an execution system controller and a standby system controller in an instrumentation system that controls a production process of a production facility. A power supply element that supplies power to the controller, a detection circuit that detects an abnormality in the power supply element, and a detection circuit that detects an abnormality in the power supply element issues a request to switch the execution right from the execution system controller to the standby system controller And a duplex control circuit for transmitting to the network.

  According to the present invention, in order to increase the reliability of a control controller that controls the production process of a plant, in a redundant system having an execution system controller and a standby system controller, it is an accidental failure of a power generation element of the execution system controller. However, without being affected by the standby system controller, it is possible to build a duplex control switching method that can switch the execution right to the standby system controller if the standby system controller is normal, and plant control can be continued. A simple control system can be provided.

It is a block diagram which shows the main structures of a waste incineration plant. It is a block diagram which shows the main structures of the instrumentation system of a refuse incineration plant. It is a block diagram explaining the structure of FIG. 2 in detail. It is a time chart of an execution system controller and a standby system controller. It is a time chart of an execution system controller and a standby system controller. It is a flowchart which shows the execution content of an execution system controller. It is a flowchart which shows the execution content of a standby system controller. It is a block diagram which shows the structure of the 1st power generation element of a control controller, and a duplication control circuit. It is a flowchart which shows operation | movement of the execution system controller at the time of the overvoltage detection of a 1st power supply.

  Embodiments of the present invention will be described below with reference to the drawings.

〔Example〕
FIG. 5 is a time chart of the execution system controller and the standby system controller. The first power source is generated by an accidental failure of the first power generation element 309 supplied to the CPU 306 and the equalization controller 305 of the execution system controller 302 shown in FIG. The execution right switching timing to the standby system controller 303 in the redundant control circuit when is overvoltage is shown. FIG. 6 is a flowchart showing the execution contents of the execution system controller 302, and FIG. 7 is a flowchart showing the execution contents of the standby system controller 303.

  The first power generation element 309 that generates the first power supplied to the CPU 306 and the equalization controller 305 of the execution system controller 302 may become overvoltage with time due to an accidental failure. In FIG. 5, at the first time 501 when an abnormality occurs, the first power supply is still at a normal voltage, and the CPU 306 and the equalization controller 305 of the execution system controller 302 are operating normally. At the second time 502, the voltage of the first power supply reaches the abnormal voltage 1 and becomes an overvoltage, so that the CPU 306 and the equalizing controller 305 of the execution system controller 302 become abnormal. At this time, equalization data is not transmitted from the equalization controller 305 to the equalization controller of the standby controller 303. At this time, a timing 503 for detecting an equalized data transmission error detected by the equalizing controller 305 is added to the execution right switching factor due to the abnormality of the CPU 306 in the duplication control circuit 308 of the executing system controller 302, thereby executing the execution system shown in FIG. As shown in the operation flow of the controller 302, an equalized data transmission error is detected (step 601), an execution right switching request is issued to the standby controller 303, and data indicating detection of the equalized data transmission error is output to the console 201 (step). 602). At this time, the error report to the console 201 of the execution system controller 302 is made from the CPU 306 shown in FIG. 3 via the Ethernet controller 304, and the error log 314 is left in the console 201. Since the date and time (yyyy / mm / dd hh: mm: ss) at which the error occurred are added to the error log 314, it is easy to identify the cause of the error.

  Further, as shown in FIG. 6, the operation flow of the execution system controller 302 detects an abnormality of the CPU (step 603), and rejects the subsequent execution right switching. On the other hand, in the standby system controller 303, as shown in FIG. 7, before the equalization controller 305 of the execution system controller 302 becomes abnormal and the equalization monitoring timer expires, the execution system controller 302 switches the execution right due to an equalize data transmission error. A request is output (step 701). This step allows the standby controller 303 to accept execution right switching (step 706), and the standby controller 303 performs the same operation as the execution controller 302 (step 707). On the other hand, in the prior art, when there is no execution right switching request step 701 and equalization data is not received due to an abnormality (step 702), the equalization monitoring timer is activated (step 703), and the equalization monitoring timer is timed up after the timer is activated. Then (Step 704), the duplexing control circuit of the standby system controller 303 detects its own CPU abnormality (Step 705), and rejects acceptance of the execution right switching request sent from the subsequent execution system controller 302. It will stop.

  FIG. 8 is a block diagram illustrating the configuration of the first power generation element and the duplex control circuit of the controller 204. The first power generation element 309 that generates the first power to be supplied to the CPU 306 and the equalization controller 305 of the execution system controller 302 becomes an overvoltage as time passes as shown in FIG. When the abnormal voltage becomes 1 at 2 time 502, the equalizing controller 305 becomes abnormal, and the equalizing data is not transmitted to the standby controller 303. A circuit for detecting an overvoltage of the first power supply and a circuit 801 for lighting and driving the overvoltage detection LED when overvoltage is detected are provided in each of the execution system controller and the standby system controller, and the overvoltage detection LED 802 is lit. When the overvoltage of the first power supply is detected, the duplex control circuit 308 makes a request for switching the execution right executed in step 701 in FIG. 7 and transmits a duplex control signal.

  FIG. 9 is a flowchart showing an operation of the execution system controller 302 when an overvoltage of the first power source shown in FIG. 8 is detected. In the execution system controller 302, the abnormal voltage 1 of the first power source shown in FIG. 5 that has become an overvoltage due to an accidental failure of the first power generation element 309 that generates the first power source is detected by the circuit 801 that detects the overvoltage (step 801). 901). When the overvoltage of the abnormal voltage 1 is detected, the duplication control circuit 308 requests the standby controller 303 to switch the execution right, and the circuit 801 for driving the overvoltage detection LED 802 to turn on controls the lighting of the overvoltage detection LED 802. Perform (step 902). After the execution right switching request, the execution system controller 302 detects an abnormality of the CPU 306 (step 903), and operates to reject acceptance of subsequent execution right switching requests. Thereby, the control by the execution system controller 302 in which the overvoltage of the first power supply from the first power generation element 309 is generated is not performed, and the control can be switched to the control by the standby system controller 303.

  As described above, according to the embodiment of the present invention, when the equalizing controller becomes abnormal due to an accidental failure of the generating element of the first power source supplied to the CPU or the equalizing controller in the execution system controller, the standby system controller Before the equalization data can be received, the standby controller switches the execution right before the equalization reception error is detected by making a request for switching the execution right to the standby controller by the duplex control circuit. By doing so, it becomes possible to construct a switching method of duplex control that can switch the execution right to the standby controller if the standby controller is normal, and provide a control system capable of continuing plant control Can do.

  As described above, in the duplication control execution right switching system according to the present invention, the conventional system is used in the duplication system having the execution system controller and the standby system controller in order to increase the reliability of the control controller for controlling the production process of the plant. If the standby controller is normal, the execution right can be switched to the standby controller without being affected by the standby controller even if it is an accidental failure of the power generation element of the active controller that was not considered in Therefore, it is possible to provide a highly reliable duplex control switching method.

101 Garbage Pit 102 Incinerator 201 Operation Console 203 Instrumentation System 204 Control Controller 302 Execution System Controller 303 Standby System Controller 305 Equalization Controller 306 CPU
308 Redundant control circuit 309 First power generation element 313 Plant control measuring instrument

Claims (2)

In a control system comprising a redundant system having an execution system controller and a standby system controller in an instrumentation system that controls the production process of a production facility,
A power supply element for supplying power to the equalizing controller of the execution system controller;
A detection circuit for detecting an abnormality of the power supply element;
A duplex control circuit that transmits a request to switch the execution right from the active controller to the standby controller when the detection circuit detects an abnormality in the power supply element; unit.   2. The standby system unit according to claim 1, wherein the standby system unit detects that the transmission of equalize data transmitted from the equalize controller of the execution system controller to the standby system controller has stopped, and newly executes an execution right from the execution system controller. A control system characterized by rejecting a switching request.

Images