JP2013211763A - Redundant communication device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To avoid an adverse effect to equipment such as a controller caused by the increase of abnormal incoming packets.SOLUTION: A redundant communication device includes: first and second signal paths (1a, 1b) for transmitting data packet signals including a UDP packet having a UDP check sum portion; a first communication unit (110P) connected to the first signal path, for receiving a data packet signal to transfer to control means (120) for processing data included in the UDP packet; and a second communication unit (110S) connected to the second signal path, for receiving a data packet signal to transfer to the control means. The first and second communication units include: error detection units (52, 53, 57) for inspecting the presence or absence of a bit error in the UDP packet on the basis of the UDP check sum; and communication interception units (58, 59, 60, 61) for suspending the transfer of the data packet signal to a control unit, when the number of occurrence of bit errors in a predetermined first time period exceeds a reference value.

Description

  The present invention relates to a communication interface of a device connected to a network such as a process control system, and more particularly to improvement of a redundant communication interface.

  For example, a process controller (a computer system that controls a process) is used to control process devices arranged in various control processes such as a production facility, a water treatment facility, and a building air conditioning facility via a network. This controller executes a control program to constantly monitor the operation state (process data) of the process and adjust the process parameters so that the required control can be performed without error. Packet data such as process data and control information is transmitted from the process equipment to such a controller via a network such as Ethernet (registered trademark of Xerox Corporation).

  In the packet data, there may be an error packet in which the original code is changed due to noise in the network, connection failure, failure of the transmission device, or the like. Therefore, an FCS (frame check sequence) field is provided in the frame of the packet data, and a result (CRC data) obtained by performing CRC calculation on the packet data on the transmission side is recorded in the FCS field and transmitted. On the receiving side, the same CRC calculation is performed on the received packet data to determine whether or not the calculation result matches the CRC data, and whether or not a packet error has occurred is determined.

  For example, in the communication device and the switch processing device described in WO 2006/121014 (Patent Document 1), an example in which DCS (data check sequence) is added to the frame of packet data in addition to FCS (frame check sequence) is shown. Has been.

WO 2006/121014

The controller connected to the network performs error checking as described above on all received packet data, discards abnormal packet data, and uses only normal packet data.
However, some abnormal packets cannot be eliminated by FCS or DCS depending on the mode of occurrence of bit errors. If abnormal packets detected by FCS or DCS are increasing, it is considered that abnormal packets that cannot be excluded also increase. This is not preferable for a controller that performs process control.

  Therefore, an object of the present invention is to make it possible to reduce the influence on a connected device such as a controller when the number of incoming abnormal packets increases.

  In order to achieve the above object, a redundant communication device according to the present invention is connected to a first signal path and a second signal path for transmitting a data packet signal including a UDP packet provided with a UDP checksum portion, and the first signal path. A first communication unit for receiving the data packet signal and transferring it to a control means for processing data contained in the UDP packet; and the control means for receiving the data packet signal connected to the second signal path A second communication unit for transferring to the first and second communication units, wherein the first and second communication units check for a bit error in the UDP packet based on the UDP checksum, and a predetermined first A communication blocking unit that stops transferring the data packet signal to the control unit when the number of occurrences of the bit error in time exceeds a reference value.

  By adopting such a configuration, it is possible to avoid data transfer that has a high possibility of including an error to the control means. Thereby, an erroneous output of the control means is avoided.

  Preferably, the first and second communication units may further detect the bit error when the bit error is not detected even after a predetermined second time has elapsed since the occurrence of the previous bit error, or when the bit error has occurred at the predetermined first time. A means canceling unit for canceling the suspension of the transfer when the number of occurrences falls below a reference value is provided. As a result, the transfer of the data packet signal is resumed with a low possibility of including error data.

  Preferably, the control means includes a plurality of control units (redundant control units) provided in parallel, and the data packet signal is transferred from the first and second communication units to each control unit. Thereby, the redundant communication device is combined with the controller for parallel redundant operation.

  The redundant communication device of the present invention receives the data packet signal connected to the first signal path and the first and second signal paths for transmitting the data packet signal including a checksum portion for detecting an error. A first communication unit that transfers data included in the data packet signal to a control unit that processes data, and a second communication that is connected to the second signal path and receives the data packet signal and transfers the data packet signal to the control unit And the first and second communication units check the presence of a bit error in the data packet based on the checksum, and the occurrence of the bit error at a predetermined first time. A communication cut-off unit that stops transferring the data packet signal to the control unit when the number exceeds a reference value.

  Preferably, the first and second communication units may further detect the bit error when the bit error is not detected even after a predetermined second time has elapsed since the occurrence of the previous bit error, or when the bit error has occurred at the predetermined first time. A means canceling unit for canceling the suspension of the transfer when the number of occurrences falls below a reference value.

  Preferably, the checksum portion for detecting the error is a part of a data packet such as a UDP checksum portion or a frame checksum.

  In addition, a device according to the present invention includes the redundant communication device described above.

  According to the present invention, when the rate at which the data packet signal flowing into the device from the redundant network includes an error bit is high, the transfer of the data packet signal from the corresponding network to the device is blocked, and a relative error occurs. Since the data packet signal is transferred from the network with a low rate including bits, the influence on the connection device such as the controller is avoided.

It is explanatory drawing explaining the example of the triple parallel redundant controller to which the redundant communication apparatus of this invention was applied. It is explanatory drawing explaining a UDP packet. It is explanatory drawing which illustrates the structure of a network communication part roughly. It is explanatory drawing explaining the packet test | inspection function provided in the network communication part. It is explanatory drawing explaining the verification capability of the frame error of FCS checksum and UDP checksum. It is explanatory drawing explaining the packet test | inspection function in the triple parallel redundant controller of an Example. It is explanatory drawing explaining the packet test | inspection function in the triple parallel redundant controller of a reference example.

Embodiments of the present invention will be described below with reference to the drawings.
The redundant communication device according to the embodiment includes first and second signal paths for transmitting a data packet signal (including packet signals of various formats such as a UDP packet and an IP packet) including a checksum portion for detecting an error, and a first signal A first communication unit connected to the path for receiving a data packet signal and transferring the data contained in the data packet signal to a control means for processing; and a second communication path connected to the second signal path for receiving and controlling the data packet signal A second communication unit for transferring to the means. The first and second communication units include an error detection unit that checks the presence or absence of a bit error in the data packet based on the checksum, and data when the number of occurrences of bit errors in a predetermined first time exceeds a reference value. And a communication blocking unit that stops transfer of the packet signal to the control unit.

FIG. 1 is an explanatory diagram illustrating an example in which the present invention is applied to a network communication unit of a triple parallel redundant controller.
The redundant controller shown in the figure includes two network communication units 110P and 110S that communicate with the redundant network 1 (signal lines 1a and 1b) of the control system, and three control units 120P, 120S, and 120T that perform control computation. And I / O units 130P and 130S for communicating with field devices connected to the local network.

  The duplex network 1 is a duplex of a local area network (LAN), and the same data packet is transmitted to the signal lines 1a and 1b. For example, the Ethernet standard is used for the network. The network communication units 110P and 110S are connected to the signal lines 1a and 1b, respectively. To the control units 120P, 120S, and 120T. Further, the network communication units 110P and 110S receive the three (internal format) packet data output from the control units 120P, 120S, and 120T, convert the packet data into Ethernet format packet data, and the duplex network signal line 1a and Send to 1b. The network communication units 110P and 110S constitute a redundant communication device.

  Each control unit receives data and the like from the network communication units 110P and 110S, performs input processing, arithmetic processing, sequence processing, output processing, controller communication, event processing, and the like according to a program introduced in advance, and outputs the I / O Output to the O units 130P and 130S. Further, it receives data output from the I / O units 130P and 130S, performs data processing, and outputs the data to the network communication units 110P and 110S. Alternatively, a signal is sent to the I / O units 130P and 130S. Each control unit and each I / O unit are connected by, for example, USB.

  The I / O units 130P and 130S relay signals between each control unit and a feel device or server device connected to the duplicated local bus 2 (2a, 2b). The local bus 2 is an Ethernet or a VL-bus (standard name). Field devices (facility devices) 31 to 33 installed in the environment to be controlled are connected to the local bus 2.

  In the above-described configuration, each control unit of the triple parallel redundant controller inputs / outputs data via the network communication unit and outputs control data of the field device to the I / O unit. When an input or event occurs from the network 1, each network communication unit delivers data to each of the triple control units, and each control unit executes a calculation process. When it is necessary to return the calculation result to the I / O unit to be controlled or the network 1, the processing result is transferred to each I / O unit or each network communication unit. At this time, the data sent from the three control units 120P, 120S, and 120T are subjected to majority processing in each I / O unit and each network communication unit. If at least two or more pieces of data have the same content, the I / O unit outputs to the field device, and the network communication unit outputs a data signal to the network 1.

  FIG. 2 shows an example of a UDP packet that is packet data in the Ethernet format. In the embodiment, data packets are exchanged between the network communication unit and the external network 1 in the form of UDP packets, and between the network communication unit and the control unit in the form of UDP packets. And an external network 1 may be performed in the form of IP packets.

  As shown in the figure, the UDP packet is composed of, for example, a 6-byte UDP header and a data portion (arbitrary data length) of 1474 bytes. The UDP header has a 2-byte source port number, 2-byte destination port number, 2-byte UDP datagram size information, and 2-byte UDP checksum. In the embodiment, a frame checksum (FCS) is further provided in the last 4 bytes of the data part so that an error check of the data part can be performed separately by application, but this is not essential to the present invention. The UDP checksum is a value added for checking the reliability of the data of the UDP packet on the receiving side. For example, CRC calculation is performed on each value of the UDP virtual header part, UDP header part, and data part added to the calculation in the area before the UDP checksum on the transmission side, or all data is overflowed in bytes (digit overflow) There are various calculation methods, such as adding (to ignore) and obtaining the value of the lower 4 bytes.

  The IP packet is configured, for example, by adding a 20-byte IP header to the leading end of the UDP packet and a 4-byte frame check sequence (FCS) at the trailing end. In the frame check sequence FCS, for example, CRC calculation is performed on each value of the IP header and IP packet data (UDP packet) portions before this, and the check value is recorded as a checksum. Note that a checksum by another calculation method may be used as described above.

  FIG. 3 is an explanatory diagram illustrating functions of the network communication unit 110P. The network communication unit 110P includes a first Ethernet controller 111 connected to the signal line 1a of the network 1, a three-port switching hub 114 to which the control units 120P to 120T are connected, and a second Ethernet controller connected to the switching hub 114. And a microcomputer system (MPU) 112 connected between the first and second Ethernet controllers 111 and 113. With these configurations, the network communication unit 110P takes in the UDP packet addressed to itself from the network 1 and transmits it to the control units 120P to 120T. Further, a majority process is performed on the three UDP packets output from the control units 120P to 120T, and the UDP packets are reconfigured and transmitted to the network 1. The network communication unit 110S is configured similarly.

  As shown in FIG. 4, in this embodiment, the network communication unit of the controller is provided with a packet inspection function. The packet inspection function checks the error of each packet received from the network, and if there is an error, stops transmitting the packet to the control unit. In addition, when the number of errors per predetermined first time exceeds a reference value, a function of stopping (blocking) transmission of a packet to the control unit is provided. If the packet error does not occur even after a predetermined second time has elapsed after the packet error is detected, the suspension of packet transmission is cancelled.

  As shown in the figure, the UDP packet received from the network 1 includes an FCS reading unit 51 that reads the value of the FCS part of the UDP packet, a UCS reading part 52 that reads the value of the UDP checksum part, and an FCS calculation of the received UDP packet. And the CRC check unit 53 and the FIFO unit 54 for calculating the UDP checksum. The FIFO unit 54 is a pre-read first-out memory.

  The collation unit 55 determines whether the value recorded in the FCS part of the UDP packet matches the FCS checksum value calculated by the CRC calculation part 53. If they do not match, the error counting unit 56 counts FCS checksum errors as errors.

  Further, the collation unit 57 determines whether the UDP checksum value recorded in the UCS part of the UDP packet matches the UDP checksum value calculated by the CRC calculation part 53. The verification result is notified to the determination unit 61. Further, the mismatch is sent as an error to the error counter 58, and a UDP checksum error is counted. The error counter 58 receives a time-out output from the first timer 59 every first set time, and the error counter 58 outputs the number of errors per first set time to the determiner 61. Further, the error output of the collation unit 57 is sent to the second timer 60, and the time-out output is sent to the determination unit 61 when the subsequent error output does not occur even after the second set time has elapsed from the preceding error output.

  As described above, when the checksum matching result matches, the determination unit 61 outputs the UDP packet held in the FIFO 54 to a subsequent circuit (not shown). This UDP packet is reconstructed by a subsequent circuit and output to the control unit via the internal Ethernet. When a mismatch (error) is notified from the collation unit 61 to the determination unit 61, the determination unit 61 instructs the discard of the UDP packet held in the FIFO 54.

  Further, when the number of error occurrences per predetermined time (for example, 60 minutes) exceeds the reference value (for example, 3) from the error counting unit 58, the determination unit 61 causes the FIFO 54 to check whether the UDP packet collation result is good or not. Then, the output (transfer) of the UDP packet to the subsequent circuit is stopped. The determination unit 61 cancels the output stop of the UDP packet by the output from the second timer 60 (when no error output occurs for a second set time (for example, 30 minutes)). Alternatively, it may be canceled when the number of error occurrences per predetermined time falls below a reference value. The determination unit 61 notifies the control units 120P to 120T of operation states such as discarding the error packet, stopping the output of the UDP packet, and recovering from the output stop, and responds according to the error packet status on each control unit side. Make it possible.

  By doing so, reception of a packet data group in a state where there is a high possibility that an error has occurred in the data portion of the data packet is avoided. As a result, the occurrence of problems in the control unit at the subsequent stage is prevented. In the embodiment, the Ethernet is duplexed (A system, B system), and even if one communication system (for example, B system) is cut off, the other communication system (for example, A system) can transmit data packets. It is possible to continue reception.

  In the example shown in FIG. 4, the UDP checksum error detection function may be used to block UDP packets, or the FCS checksum error detection function 51 may be used. However, the detection accuracy is better when the error detection function of the UDP checksum is used.

FIG. 5 shows an example in which various bit error patterns are applied to the test UDP packet and the error detection functions of the UDP checksum and the FCS checksum are compared. When an error is generated by inverting one bit in a UDP packet, there is no difference in the error detection function between the UDP checksum and the FCS checksum, but if the number of error bits is increased, such as 2-bit inversion, the UDP It was shown that the checksum error detection function is superior.
Therefore, it is desirable to control the transmission of the UDP packet based on the error detection function of the UDP checksum.

  FIG. 6 is an explanatory diagram for explaining an operation example of the triple parallel redundant controller having the packet inspection function shown in FIG.

  First, a case where a “normal” UDP packet is transferred from the duplex network 1 (1a, 1b) to the controller as shown in FIG.

(1) The UDP packet p is transmitted from the A-system network 1a and the B-system network 1b to the network communication units 110P and 110S, respectively. The network communication units 110P and 110S have the UDP checksum error detection function shown in FIG.
(2) The network communication units 110P and 110S perform an error check using the UDP checksum. If there is no error, the UDP packet is transferred to the control units 120P to 120T.
(3) The control units 120P to 120T perform the FCS check of the UDP packet, and if there is no abnormality, process the data of the UDP packet that has arrived first.

  Next, as shown in FIG. 6B, a case where a part of the UDP packet transferred from the duplex network 1 is “abnormal” will be described.

(1) A “normal” UDP packet p is transferred from the A-system network 1a to the network communication unit 110P, and an “abnormal” UDP packet p is transmitted from the B-system network 1b to the network communication unit 110S.
(2) The network communication units 110P and 110S perform an error check using the UDP checksum of the UDP packet. The network communication unit 110P that does not find an error transfers the UDP packet to the control units 120P to 120T. The network communication unit 110S that has found the error does not transfer the UDP packet to the control units 120P to 120T. Further, when the error packet rate exceeds the reference value per predetermined time, the network communication unit 110S blocks the transfer of the UDP packet from the B-system network until the error is recovered.
(3) The control units 120P to 120T perform an FCS check on the UDP packet received from the A network, and if there is no abnormality, perform data processing on the UDP packet.

FIGS. 7A and 7B are explanatory diagrams for explaining a reference example for comparison.
First, a case where a “normal” UDP packet is transferred from the duplex network 1 (1a, 1b) to the controller as shown in FIG.

(1) The UDP packet p is transmitted from the A-system network 1a and the B-system network 1b to the network communication units 110P and 110S, respectively. The network communication units 110P and 110S are not provided with the aforementioned UDP checksum error detection function.
(2) The network communication units 110P and 110S transfer the UDP packet p to the control units 120P to 120T.
(3) The control units 120P to 120T perform an FCS check on the UDP packet p, and if there is no abnormality, perform data processing on the UDP packet p that has arrived first.

  Next, a case where the UDP packet is “abnormal” as illustrated in FIG. 6B will be described.

(1) A normal UDP packet p is transferred from the A-system network to the network communication unit 110P, and an “abnormal” UDP packet p is transmitted from the B-system network to the network communication unit 110S.
(2) The network communication units 110P and 110S transfer the UDP packet p to the control units 120P to 120T.
(3) The control units 120P to 120T perform an FCS check of each UDP packet p received from the A-system network and the B-system network, discard the abnormal UDP packet p, and use the normal UDP packet p. Normal UDP packet data processing is performed.

  In the above reference example, all abnormal UDP packets are received and processed in the controller (control unit), whereas in the embodiment, abnormal UDP packets are blocked by the network communication unit at the controller entrance and entered in the control unit. Do not accept. Therefore, the possibility that the process by the erroneous data in the control unit is executed is reduced. In particular, in a communication state in which the error rate of a UDP packet due to a checksum is high, an error (not detected) existing in a UDP packet (because not all data errors are detected by a UDP checksum or FCS checksum). It is thought that the number of data is also increasing. It is considered that the safety of the output of the control unit is improved by not processing such error data by the control unit.

  Further, as described above, since the UDP checksum has higher accuracy than the FCS checksum, it is conceivable that the UDP checksum is verified in the control unit, but the UDP packet is sent from the network communication unit to each control unit side. In the transfer process, the communication unit reconstructs the UDP packet and transfers it to the control unit side. At this time, since the communication unit reconstructs a packet with a correct UDP checksum or a packet without a UDP checksum (not supporting the UDP checksum), information on the UDP checksum error at the time of reception is lost. Therefore, the only way to know the signs of packet data destruction on the control side is to use an FCS checksum that has a lower verification capability than the UDP checksum. In this embodiment, it is preferable that the UDP checksum is verified by the network communication unit.

  It is also conceivable that the network communication unit verifies the UDP checksum but does not block communication, and the control unit performs communication blocking for the corresponding system. In this case, the three control units for the parallel redundant operation perform the same processing, which is inefficient. According to the embodiment, this inconvenience is avoided.

  In the embodiment, the network communication unit verifies with the UDP checksum. However, the communication may be blocked by the FCS bit error (frame error) detection function (51, 55, 56, 61). The error detection performance is relatively inferior to the UDP checksum, but there may be a case where the UDP checksum cannot be used for some reason.

  The checksum portion for detecting the error may be a UDP checksum portion, a frame checksum portion, or a part of a data packet other than these.

  The redundant communication device of the present invention is suitable for use in devices connected to a network, such as controllers and field devices.

1 Duplex network, 2 Duplex local bus, 110P, 110S Network communication unit, 120P, 120S, 120T Control unit, 130P, 130S I / O unit

Claims (4)

First and second signal paths for transmitting a data packet signal including a UDP packet provided with a UDP checksum portion;
A first communication unit connected to the first signal path for receiving the data packet signal and transferring the data included in the UDP packet to control means;
A second communication unit connected to the second signal path for receiving the data packet signal and transferring it to the control means;
The first and second communication units are
An error detection unit that checks the presence or absence of a bit error in the UDP packet based on the UDP checksum;
A communication blocking unit for stopping transfer of the data packet signal to the control unit when the number of occurrences of the bit error in a predetermined first time exceeds a reference value;
A redundant communication device comprising: The redundant communication device according to claim 1,
The first and second communication units further include
When the bit error is not detected even after a predetermined second time has elapsed from the occurrence of the previous bit error, or when the number of bit errors occurring at the predetermined first time falls below a reference value, the transfer is stopped. A means for canceling and a redundant communication device provided. The redundant communication device according to claim 1 or 2,
The control means comprises a control unit provided in parallel,
The redundant communication device, wherein the data packet signal is transferred from the first and second communication units to each control unit.   The apparatus containing the redundant communication apparatus in any one of Claims 1 thru | or 3.