JP2015127926A - Communication system and communication control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To propose a communication system and communication control method that can implement a control high in reliability.SOLUTION: A communication system is configured to include: a plurality of master devices 2A and 2B; a plurality of networks that is connected to each master device, respectively and includes a ring type network topology having one or more slave devices 3A and 3B connected; and a main/sub switching device that sets any one of the master devices to a main system, and sets the other master device to a sub system and switches the setting of the master device to the main and sub systems as needed. The master device newly set to the main system is configured to: execute necessary computation processing on the basis of information written in a communication frame by the corresponding slave device; generate a communication frame in which information obtained by the computation processing is stored in a corresponding part; and transmit the generated communication frame to each network and the master device set in the other system. When a problem occurs in the master device set to the main system, the main/sub switching device is configured to include a first step of switching the main system and sub system of the master devices.

Description

  The present invention relates to a communication system and a communication control method, and is suitable for application to, for example, a remote I / O (Input / Output) system.

  In recent years, EtherCAT (Ether for Control Automation Technology) (registered trademark), which is an Ethernet (registered trademark) -based fieldbus system, has attracted attention as a master-slave communication method.

  In Ethercat (registered trademark), each slave processes a communication frame that periodically flows on a network (hereinafter referred to as a fixed-period frame) on the fly. Specifically, when each slave receives a fixed-period frame, it reads / writes data from / to an area allocated to itself in the fixed-period frame and simultaneously forwards the communication frame to the next slave.

  Data transmission / reception processing in the slave is performed at high speed by an Ethercat (registered trademark) slave controller mounted in the slave. For this reason, the network performance of the slave does not depend on the microcomputer performance of the slave. Usually, the delay of a fixed-cycle frame in each slave is only about a few [ns], thereby ensuring high-speed data transmission and real-time performance.

  Such high speed and real-time performance of data transmission of Ethercat (registered trademark) is useful in factories and plants that require real-time control. In recent years, communication systems using Ethercat (registered trademark) have been further improved. Many various inventions for improving performance and reliability have been proposed (see, for example, Patent Document 1).

JP2011-176718A

  By the way, in the case of Ethercat (registered trademark), when communication with the subsequent slave is interrupted, the fixed-cycle frame transmitted from the previous stage is sent to the source of the fixed-cycle frame without being transferred to the slave. A function called loopback is defined.

  As a result, in a remote I / O system to which Ethercat (registered trademark) is applied as a communication method, for example, by adopting a ring-type network topology as a network topology, even when a network cable is disconnected or a slave failure occurs, Communication between each slave in which no failure has occurred and the master can be ensured.

  However, even in such a remote I / O system, for example, when a network cable is disconnected or a slave failure occurs at multiple locations on the network, the master can communicate with the slave existing between the failed locations. There was a problem of disappearing. For this reason, in the remote I / O system having this type of configuration, it is desired to further improve the fault tolerance.

  In a remote I / O system to which Ethercat (registered trademark) is applied as a communication method, there is a method of distributing a fixed-cycle frame to two masters using a general-purpose switch device such as a switching hub when duplicating a master. Widely used.

  In such a remote I / O system, communication with the slave is performed by one master set as the master, and the other master set as the slave communicates with the slave only by monitoring the periodic frame. Can not do. Therefore, if a failure occurs in any of the slaves, the master master can identify the failed slave (hereinafter referred to as the failure slave) by bus scan, but the slave slave The failed slave cannot be identified.

  However, depending on the content of the failure that occurred in the slave, incorrect data may be written in the area assigned to the slave in the fixed-cycle frame. In such a case, the master in the main system can specify the failed slave by the bus scan as described above, so that data from the failed slave can be prevented from being used. However, since the slave master cannot specify the failed slave as described above, the data from the failed slave is used as valid data.

  As a result, if a failure occurs in the master master immediately after the above-described failure occurs in the slave and the master master and slave are switched, the master (original) There is a problem in that the slave master) performs control using incorrect data given from the failed slave.

  When a slave failure occurs, the master master identifies the failed slave by bus scan, but when the number of slaves is large, it takes a certain amount of time to identify the failed slave. Even in the master, there is a problem that control is performed using incorrect data transmitted from the failed slave.

  The present invention has been made in consideration of the above points, and intends to propose a communication system and a communication control method having high fault tolerance and high reliability.

  In order to solve such problems, in the present invention, in a communication system to which a master-slave communication protocol is applied, a plurality of master devices are connected to each of the master devices, and one or a plurality of slave devices are connected. A plurality of networks having a ring-type network topology, and any one of the master devices is set as a master system, the other master device is set as a slave system, and a master-slave of the master device is set as necessary. A master / slave switcher for switching is provided, and the master device set as a master sends a communication frame of a predetermined format to each of the networks and the master device set as a slave, and is connected to each of the networks. Each of the slave devices read / write information in the area allocated to itself in the communication frame The master device set as the main system performs the necessary arithmetic processing based on the information written in the communication frame by the corresponding slave device, and stores the information obtained by the arithmetic processing in the corresponding location. The communication frame is generated, and the generated communication frame is transmitted to each network and the master device set to another system, and the master-slave switcher has a failure in the master device set to the main system. When this occurs, the master system and the slave system of the master device are switched.

  According to the present invention, there is also provided a communication control method in a communication system to which a master-slave communication protocol is applied, wherein the communication system is connected to a plurality of master devices and each of the master devices. A plurality of networks having a ring-type network topology to which the slave devices are connected, and any one of the master devices is set as a master system, the other master devices are set as slave systems, and if necessary A master-slave switching unit that switches the master-slave of the master device, and the master device set as a master sends a communication frame of a predetermined format to each of the networks and the master device set as a slave Each slave device connected to each network is assigned to itself in the communication frame. The master device that reads / writes information in the area and is set as the main system executes necessary arithmetic processing based on the information written in the communication frame by the corresponding slave device, and information obtained by the arithmetic processing The communication frame stored in the corresponding location is generated, and the generated communication frame is transmitted to each network and the master device set to another system, and the master-slave switching unit is set to the main system. When a failure occurs in the master device, a first step of switching between the master system and the slave system of the master device, and the master device newly set as the master system, the corresponding slave device sends the communication frame Before executing the necessary calculation processing based on the information written in the information, generating the communication frame storing the information obtained by the calculation processing in the corresponding location, and And a communication frame to be provided and each of said network, and a second step of transmitting to said master unit is set to the other system.

  According to the communication system and the communication control method of the present invention, even when a failure occurs in the master device or a failure occurs in the network, the entire communication system can continue processing without any problem.

  ADVANTAGE OF THE INVENTION According to this invention, the communication system and communication control method which can construct | assemble a highly reliable network system are realizable.

It is a block diagram which shows the whole structure of the remote I / O system by this Embodiment. (A)-(E) is a conceptual diagram which shows the frame format of the fixed period frame in an Ethercat (trademark) protocol. It is a block diagram which shows schematic structure of an I / O slave. It is a flowchart which shows the process sequence of a link down process at the time of CPU failure. It is a flowchart which shows the flow of a series of processes performed in a remote I / O system when CPU watchdog timer abnormality generate | occur | produces in an I / O slave.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

(1) Configuration of Remote I / O System According to this Embodiment FIG. 1 shows a schematic configuration of a remote I / O system 1 for a gas turbine power plant. The remote I / O system 1 is a communication system to which an Ethercat (registered trademark) protocol is applied as a communication protocol, and includes two redundant control devices (hereinafter referred to as first and second control devices) installed in a control room. (Referred to as a second control device) 2A, 2B.

  1st and 2nd control apparatus 2A, 2B is a control apparatus which controls the whole gas turbine power generation plant, respectively, main CPU (Central Processing Unit) 10A, 10B, 1st master CPU11A, 11B, 2nd Master CPUs 12A and 12B.

  The main CPUs 10A and 10B are processors that control the operation of the entire first or second control device 2A or 2B, and the first master CPUs 11A and 11B and the second master connected via the internal buses 13A and 13B. Various types for controlling a gas turbine (not shown) installed at a remote site based on sensor outputs of various types of sensors at the remote site collected by the CPUs 12A and 12B and various programs stored in a memory (not shown). Execute control processing.

  The first master CPUs 11A and 11B and the second master CPUs 12A and 12B are processors that function as masters in the connected A-system or B-system networks 3A and 3B. The first master CPUs 11A and 11B are connected to an A-system network 3A having a ring-type network topology, and the second master CPUs 12A and 12B are connected to a B-system network 3B having a ring-type network topology. Is done.

  The A-system network 3A includes first and second switching hubs 20A and 21A and first and fourth media converters 22A and 25A respectively disposed in a control room, and second and third switching nodes disposed at a remote site. Media converters 23A and 24A, an AI (Analog Input) slave 26A, an AO (Analog Output) slave 27A, a DI (Digital Input) slave 28A, and a DO (Digital Output) slave 29A.

  And between the first master CPU 11A of the first switching hub 20A and the first controller 2A, between the first master CPU 11B of the first switching hub 20A and the second controller 2B, and the second switching hub. Between the first master CPU 11A of 21A and the first control device 2A, and between the first master CPU 11B of the second switching hub 21A and the second control device 2B, Ethernet such as a 100BASE-TX cable (registration) Trademarks) are connected via category 5 or higher cables.

  Similarly, between the first switching hub 20A and the first media converter 22A, between the second media converter 23A and the AI slave 26A, between the AI slave 26A and the AO slave 27A, and between the AO slave 27A and the DI slave 28A. Also, between the DI slave 28A and the DO slave 29A, between the DO slave 29A and the third media converter 24A, and between the fourth media converter 25A and the second switching hub 21A, Ethernet (registered trademark) category 5 or more Connected via cable.

  On the other hand, the first media converter 22A and the second media converter 23A and the third media converter 24A and the fourth media converter 25A are connected via an optical cable 32 such as a 100BASE-FX cable, respectively. As a result, even when the remote site is located away from the control room, signal attenuation during communication between the control room and the remote site can be kept low.

  Similarly to the A-system network 3A, the B-system network 3B includes the first and second switching hubs 20B and 21B and the first and fourth media converters 22B and 25B disposed in the control room, respectively, And the second and third media converters 23B and 24B, the AI slave 26B, the AO slave 27B, the DI slave 28B, and the DO slave 29B.

  Then, between the first switching hub 20B and the second master CPU 12A of the first control device 2A, between the first switching hub 20B and the second master CPU 12B of the second control device 2B, and the second switching hub. 21B and the second master CPU 12A of the first control device 2A, and between the second switching hub 21B and the second master CPU 12B of the second control device 2B are Ethernet category 5 or higher, respectively. The other slaves are connected to each other in the same way as the A-system network 3A.

  The first switching hubs 20A and 20B and the second switching hubs 21A and 21B are switch devices on which an Ethercat (registered trademark) slave controller is mounted. Each of the first to fourth media converters 22A to 25A and 22B to 25B is an optical transmission device on which an Ethercat (registered trademark) slave controller is mounted.

  The AI slaves 26A and 26B, the AO slaves 27A and 27B, the DI slaves 28A and 28B, and the DO slaves 29A and 29B are I / O slaves each equipped with an Ethercat (registered trademark) slave controller. In the following description, the AI slave 26A, the AO slave 27A, the DI slave 28A, and the DO slave 29A are collectively referred to as an I / O slave 30A. These are collectively referred to as I / O slave 30B.

  One or a plurality of AI slaves 26A and 26B are provided on the A-system and B-system networks 3A and 3B, respectively, corresponding to the analog sensors arranged on the remote site side. The AI slaves 26A and 26B are configured to include an analog / digital converter (not shown), and digitally convert the sensor output of the corresponding analog sensor provided via the corresponding signal distributor 31, and thus obtained. The digitized sensor output (hereinafter referred to as sensor information) is transmitted from the first or second master CPU 11A, 11B, 12A, 12B of the first or second control device 2A, 2B as described later. Has a function of storing in an area allocated to itself in a fixed-period frame. Note that the “area allocated to itself in a fixed-cycle frame” here refers to an EtherCAT Datagram (EtherCAT Datagram) for the slave that will be described later with reference to FIG. The same applies to the following.

  One or a plurality of AO slaves 27A and 27B are provided on the A-system and B-system networks 3A and 3B respectively corresponding to the analog devices to be controlled such as actuators disposed on the remote site side. The AO slaves 27A and 27B are configured to include a digital / analog converter, and read out the control information stored in the area allocated to itself in the fixed-cycle frame as will be described later, and convert it into an analog signal. The analog control information is transmitted to the corresponding signal distributor 31. In this case, the signal distributor 31 calculates the average value of the analog control information given from the corresponding AO slaves 27A and 27B of the A-system and B-system networks 3A and 3B, and calculates the calculated result of the corresponding control target. Send to analog device. However, the signal distributor 31 has a larger or smaller value of the analog control information given from the corresponding AO slaves 27A and 27B of the A-system and B-system networks 3A and 3B, or a predetermined one. Only analog control information given from the AO slaves 27A and 27B of the networks 3A and 3B may be transmitted to the corresponding analog device to be controlled.

  One or a plurality of DI slaves 28A and 28B are provided on the A-system and B-system networks 3A and 3B in correspondence with the respective digital sensors arranged on the remote site side. The DI slaves 28A and 28B have a function of storing the sensor output (sensor information) of the corresponding digital sensor given through the corresponding signal distributor 31 in the area allocated to itself in the fixed period frame.

  One or a plurality of DO slaves 29A and 29B are provided on the A-system and B-system networks 3A and 3B respectively corresponding to the digital devices to be controlled provided on the remote site side. The DO slaves 29 </ b> A and 29 </ b> B have a function of reading out control information stored in an area assigned to itself in a fixed-cycle frame and sending it to the corresponding signal distributor 31 as described later. In this case, the signal distributor 31 calculates the average value of the control information given from the corresponding DO slaves 29A and 29B of the A-system and B-system networks 3A and 3B, and the calculated result is the corresponding digital object to be controlled. Send to device. However, the signal distributor 31 has a larger or smaller value of control information given from the corresponding DO slaves 29A and 29B of the A-system and B-system networks 3A and 3B, or one of the predetermined networks. Only the control information given from the 3A and 3B DO slaves 29A and 29B may be transmitted to the corresponding digital device to be controlled.

  In the remote I / O system 1 having such a configuration, a master-slave relationship between the first master CPU 11A of the first control device 2A and the first master CPU 11B of the second control device 2B in the A-system network 3A. The master-slave relationship between the second master CPU 12A of the first control device 2A and the second master CPU 12B of the second control device 2B in the B-system network 3B is controlled by the master-slave switching unit 4. . The master-slave switching unit 4 normally sets the first and second master CPUs 11A, 12A of the first control device 2A as the main system, and the first and second master CPUs 11B, 2B of the second control device 2B. 12B is set as a slave.

  The first master CPU 11A of the first control device 2A set as the main system normally communicates with all I / O slaves 30A existing on the A-system network 3A. ) A fixed-cycle frame defined by the standard is transmitted to the first switching hub 20A of the A-system network 3A at a fixed cycle (for example, 1 [ms] cycle). Further, the first switching hub 20A transfers the periodic frame transmitted from the first control device 2A to the first master CPU 11B of the second control device 2B and the first media converter 22A of the A-system network 3A. To do.

  The first media converter 22A converts the fixed-cycle frame transferred from the first switching hub 20A into an optical signal, and transmits the optical signal to the second media converter 23A via the optical cable 32. The second media converter 23A converts the optical signal transmitted from the first media converter 22A into an electrical signal, and transfers the fixed-period frame thus obtained to the AI slave 26A.

  When the AI slave 26A receives the fixed-cycle frame, the AI slave 26A acquires it after the previous fixed-cycle frame is transferred to the area allocated to itself in the fixed-cycle frame until the current fixed-cycle frame is received. Stored sensor information. Then, the AI slave 26A transfers the fixed-cycle frame storing the sensor information to the next-stage slave (AO slave 27A in FIG. 1).

  Further, when the AO slave 27A receives the fixed-cycle frame, the AO slave 27A reads the control information stored in the area allocated to itself within the fixed-cycle frame, converts the read control information into an analog signal, and corresponding signal distributor 31. And the periodic frame is transferred to the slave at the next stage (DI slave 28A in FIG. 1).

  When the DI slave 28A receives the fixed-cycle frame, the DI slave 28A acquires the period from the last transfer of the fixed-cycle frame to the area allocated to itself in the fixed-cycle frame until the reception of the current fixed-cycle frame. Stored sensor information. Then, the DI slave 28A transfers the fixed-cycle frame storing the sensor information to the next-stage slave (DO slave 29A in FIG. 1).

  Also, when the DO slave 29A receives the fixed cycle frame, the DO slave 29A reads the control information stored in the area allocated to itself in the received fixed cycle frame, and sends the read control information to the corresponding signal distributor 31. At the same time, the fixed-cycle frame is transferred to the slave at the next stage (the third media converter 24A in FIG. 1).

  The third media converter 24A converts the received periodic frame into an optical signal, and transmits the optical signal to the fourth media converter 25A in the control room via the optical cable 32. The fourth media converter 25A converts the optical signal transmitted from the third media converter 24A into an electrical signal, and transfers the fixed-period frame thus obtained to the second switching hub 21A.

  The second switching hub 21A sends the fixed-cycle frame transferred from the fourth media converter 25A to the first master CPU 11A of the first control device 2A and the first master CPU 11B of the second control device 2B. To do. Then, the first master CPU 11A of the first control device 2A that has received the fixed-cycle frame reads the sensor information stored in the fixed-cycle frame by the AI slave 26A and the DI slave 28A, and delivers the read sensor information to the main CPU 10A. .

  On the other hand, at this time, the second master CPU 12A of the first control device 2A also communicates with all the I / O slaves 30B existing on the B-system network 3B, like the first master CPU 11A. The periodic frame defined in the Cat (registered trademark) standard is periodically transmitted (with the same period as the period in which the first master CPU 11A transmits the periodic frame to the A-system network 3A). To the switching hub 20B. Further, the first switching hub 20B of the B-system network 3B transfers such a periodic frame to the second master CPU 12B of the second control device 2B and the first media converter 22B of the B-system network 3B.

  As a result, the periodic frames are sequentially transferred on the B-system network 3B in the same manner as the A-system network 3A described above, and the second frame of the first control device 2A is transmitted via the B-system second switching hub 21B. The master CPU 12A is returned to. Thus, the second master CPU 12A of the first control device 2A that has received this fixed-cycle frame reads the sensor information stored in the fixed-cycle frame by the AI slave 26B and the DI slave 28B on the B-system network 3B, The read sensor information is delivered to the main CPU 10A.

  The main CPU 10A has commands and parameters for controlling each control target at the remote site to a predetermined state based on the sensor information given from the first master CPU 11A and the sensor information given from the second master CPU 11A. Control information is generated. At this time, when there is sensor information that can be acquired only from one of the first and second master CPUs 11A due to a network failure or the like, the main CPU 10A generates control information using only the sensor information. Then, the main CPU 10A delivers the generated control information to the first and second master CPUs 11A and 12A. Thus, each of the first and second master CPUs 11A and 12A generates a fixed-cycle frame in which each of these control information is stored in a corresponding area, and the generated fixed-cycle frame is transmitted to the A system or the B system at the next transmission timing. The data is transmitted to the first switching hubs 20A and 20B of the networks 3A and 3B.

  In this way, the first or second control device 2A, 2B controls each control target at the remote site to a predetermined state based on the sensor output of each analog sensor or each digital sensor arranged at the remote site. .

  On the other hand, in the second control device 2B set as the slave at this time, the periodic frame transmitted from the second switching hub 21A of the A-system network 3A to the first master CPU 11B, and the B-system network 3B Based on the fixed-cycle frame transmitted from the second switching hub 21B to the second master CPU 12B, processing similar to that of the first control device 2A described above is executed.

  However, the first master CPU 11B and the second master CPU 12B of the second control device 2B transmit to the first switching hubs 20A and 20B a fixed-cycle frame storing the above-described control information generated by such processing. Discard without. Accordingly, in this remote I / O system 1, only the periodic frames output from the first and second master CPUs 11A and 12A of the first control device 2A set as the main system are normally the A system or It is transmitted on the B-system networks 3A and 3B.

  On the other hand, when a failure occurs in the first or second master CPU 11A, 12A of the first control device 2A set as the main system, the master-slave switching device 4 is the first or second in which the failure has occurred. First and second control devices so that the masters of the A-system or B-system networks 3A and 3B to which the master CPUs 11A and 12A are connected are the first or second master CPUs 11B and 12B of the second control device 2B. Switches the master / slave setting of 2A and 2B.

  Then, the first or second master CPU 11B, 12B of the second control device 2B switched to the main system thereafter uses the A or B system first switching hub to generate the fixed-cycle frame generated as described above. The first or second master CPU 11A, 12A of the first control device 2A, which has been transmitted to 20A, 20B and switched to the subordinate system, transmits the periodic frame generated as described above to the first Discard without transmitting to one switching hub 20A, 20B. As a result, when the master-slave relationship between the first or second master CPU 11A, 12A of the first control device 2A and the corresponding first or second master CPU 11B, 12B of the second control device 2B is switched. Are transmitted on the corresponding A-system or B-system networks 3A, 3B by the periodic frames output from the first or second master CPU 11B, 12B of the second control device 2B switched to the main system. Will be.

  2A to 2E show the frame formats of the fixed-cycle frames output from the first master CPUs 11A and 11B and the second master CPUs 12A and 12B of the first or second control devices 2A and 2B. Show.

  As shown in FIG. 2A, the periodic frame is composed of a 14-byte Ethernet (registered trademark) header field (Ethernet (registered trademark) Header) and a maximum 1500-byte Ethernet (registered trademark) data field (Ethernet (registered trademark)). (Trademark) Data) and a 4-byte FCS (Frame Check Sequence) field (FCS). The Ethernet (registered trademark) header field stores the destination of the fixed-cycle frame and the address of the transmission source, and the FCS field contains information for checking the error of the fixed-cycle frame such as a CRC (Cyclic Redundancy Check) code. Stored.

  As shown in FIG. 2B, the Ethernet (registered trademark) data field includes an 11-bit data length field (Length), a 1-bit reserve field (Reserve), and a 4-bit type field (Ty). , 44 to 1498 bytes of Ethercat (registered trademark) datagram field (1... N EtherCAT Datagrams). In the Ethercat (registered trademark) datagram field, as shown in FIG. 2 (C), one or a plurality of Ethercat (registered trademark) respectively associated with each slave to be transmitted of the fixed-cycle frame. Frame (hereinafter referred to as an Ethercat (registered trademark) datagram) is stored, and the data length field stores all the Ethercat (registered trademark) stored in the Ethercat (registered trademark) datagram field. ) Stores the total data length of the datagram. In addition, a flag that is normally set to “0” is stored in the reserve field, and a code (Ethercat (registered trademark) code indicating the type of data stored in the Ethercat (registered trademark) datagram field is stored in the type field. In this case, “0x1”) is stored.

  As shown in FIG. 2D, each Ethercat (registered trademark) datagram field includes a 10-byte datagram header field (Datagram Header), a maximum 1486-byte data field (Data), and a 2-byte WKC. (Working Counter) field. In the data field, data transmitted to the corresponding slave by the master (the first master CPU 11A, 11B or the second master CPU 12A, 12B of the first or second control device 2A, 2B) (this embodiment) The above-mentioned control information) or the data that the slave should transmit to the master (the above-described sensor information in the present embodiment) is stored. In the WKC field, a count value corresponding to the number of processes normally processed by the Ethercat (registered trademark) datagram is stored.

  Further, as shown in FIG. 2E, the datagram header field includes an 8-bit command field (Cmd), an 8-bit index field (Idx), a 32-bit address field (Address), and an 11-bit address field. Data type field (Len), 3-bit reserved field (R), 1-bit cyclic presence / absence bit field (C), 1-bit continuation presence / absence bit field (M), 16-bit Ethercat (registered trademark) ) It consists of an interrupt request register field (IRQ).

  The command field stores a code indicating the command type of the Ethercat (registered trademark) command issued by the master to the corresponding slave, and the index field stores data to be transmitted from the master to the slave or transmitted from the slave to the master. When the information to be stored is divided into a plurality of fixed-period frames and stored, an index number representing the order of the data is stored. The address field stores the address of the corresponding slave, and the data type field stores the data type of the datagram following the datagram header.

  Further, a flag indicating whether or not the fixed-cycle frame is already circulating through the corresponding slave is stored in the cycle presence / absence bit field. This flag is set to “0” when the fixed-cycle frame does not circulate through the corresponding slave, and when the fixed-cycle frame is already circulated through the corresponding slave, It is updated to “1”.

  In the continuation presence / absence bit field, a flag indicating whether or not the datagram is the last datagram stored in the Ethercat (registered trademark) datagram field (FIG. 2B) of the fixed-cycle frame. Stored. This flag is “0” if the Ethercat® datagram is the last Ethercat® datagram stored in the Ethercat® datagram field of the periodic frame. If it is not the last Ethercat® datagram, it is set to “1”. Further, the Ethercat (registered trademark) interrupt request register field is used as a register for storing an interrupt request.

(2) Configuration of I / O Slave FIG. 3 shows a schematic configuration of the I / O slaves 30A and 30B. As is clear from FIG. 3, each I / O slave 30A, 30B includes a CPU 41, an I / O control unit 42, and an Ethercat (registered trademark) slave controller 43, which are connected to each other via a bus 40. The first and second PHYs 44A and 44B, the first and second ports 45A and 45B, an operation LED (Light Emitting Diode) 46, and a failure LED 47 are configured.

  The CPU 41 is a processor that controls operation of the entire I / O slaves 30A and 30B. When the I / O slaves 30A and 30B are AI slaves 26A and 26B (FIG. 1) or DI slaves 28A and 28B (FIG. 1), the CPU 41 provides a sensor provided from the I / O control unit 42 as described later. When the information is stored in the memory 43A in the Ethercat (registered trademark) slave controller 43 and the I / O slaves 30A, 30B are AO slaves 27A, 27B or DO slaves 29A, 29B, Ethercat (registered trademark) The control information extracted from the fixed cycle frame stored in the memory 43 </ b> A in the slave controller 43 is read and transmitted to the I / O control unit 42.

  The I / O control unit 42 is configured by an FPGA (Field-Programmable Gate Array), input processing (including digital conversion processing) of sensor output of a corresponding sensor, and output processing of control information to a corresponding control target ( (Including analog conversion processing).

  Actually, when the I / O slaves 30A and 30B at the mounting destinations are the AI slaves 26A and 26B, for example, the I / O control unit 42 performs the analog / digital conversion mounted on the I / O slaves 30A and 30B. By controlling the device, the sensor output given from the corresponding analog sensor via the signal distributor 31 is digitally converted, and the sensor information thus obtained is given to the CPU 41 via the bus 40.

  The I / O control unit 42 controls the digital / analog converters mounted on the I / O slaves 30A and 30B when the I / O slaves 30A and 30B as the mounting destinations are the AO slaves 27A and 27B. By doing so, the control information given from the CPU 41 via the bus 40 is converted to analog and the control information is output to the corresponding signal distributor 31.

  Further, when the I / O slaves 30A and 30B to be mounted are the DI slaves 28A and 28B, the I / O control unit 42 receives the sensor output given from the corresponding digital sensor via the signal distributor 31 on the bus 40. When the mounting I / O slaves 30A and 30B are DO slaves 29A and 29B, the control information given from the CPU 41 via the bus 40 is output to the corresponding signal distributor 31. .

  The Ethercat (registered trademark) slave controller 43 is a slave controller compliant with the Ethercat (registered trademark) standard as described above, and reads and writes information with respect to the received periodic frame. In practice, when the I / O slaves 30A and 30B to be mounted are the AI slaves 26A and 26B or the DI slaves 28A and 28B, the Ethercat (registered trademark) slave controller 43 reads the sensor information written in the memory 43A by the CPU 41. Then, the data is written in the area allocated to the I / O slaves 30A and 30B in the received periodic frame. In addition, when the executed I / O slaves 30A and 30B are AO slaves 27A and 27B or DO slaves 29A and 29B, the Ethercat (registered trademark) slave controller 43 executes the I / O in the received periodic frame. Control information is read from the areas allocated to the slaves 30A and 30B, and the read information is stored in the memory 43A.

  Further, the Ethercat (registered trademark) slave controller 43 also has a loopback function, which is fixed when communication with the other I / O slaves 30A and 30B to be mounted is interrupted. A loopback process is performed in which the periodic frame is not transferred to the slave but sent back to the slave of the transmission source.

  The first PHY 44A is a receiving device, and is connected to the networks 3A and 3B via the first port 45A. The second PHY 44B is a transmission device and is connected to the networks 3A and 3B via the second port 45B. The first PHY 44A transmits a periodic frame provided from the connected networks 3A and 3B via the first port 45A to the Ethercat (registered trademark) slave controller 43, and the second PHY 44B transmits the Ethercat ( The fixed-cycle frame provided from the registered slave controller 43 is output to the networks 3A and 3B via the second port 45B.

(3) Link Down Function at CPU Failure By the way, in the I / O slaves 30A and 30B described above with reference to FIG. 3, the Ethercat (registered trademark) slave controller 43 operates even when the CPU 41 fails and processing is stopped. Keep doing. Therefore, for example, when the I / O slaves 30A and 30B are AI slaves 26A and 26B or DI slaves 28A and 28B, when the CPU 41 stops processing, the I / O slaves 30A and 30B are stored in the memory 43A of the Ethercat (registered trademark) slave controller 43. The Ethercat (registered trademark) slave controller 43 stores the old sensor information stored in the memory 43A in the area allocated to itself in the fixed-cycle frame and transfers it to the next-stage slave without updating the updated data. Will be.

  In this case, the first or second control device 2A, 2B set as the main system at that time causes a failure in the CPU 41 by performing a bus scan on the corresponding A system or B system network 3A, 3B. The I / O slaves 30A and 30B can be specified. However, the second or first control device 2B, 2A set as the subordinate cannot perform the bus scan of the network 3A, 3B, and identifies the I / O slave 30A, 30B where the failure has occurred. Can not do it.

  For this reason, the second or first control device 2B, 2A set as a subordinate system generates control information using the sensor information from the I / O slaves 30A, 30B in which the CPU 41 has failed as correct information, and Become. Therefore, when the master-slave relationship between the first and second control devices 2A, 2B is switched immediately after this, the second or first control device 2B, 2A newly set as the master system has failed. Control processing is performed based on old sensor information transmitted from the I / O slaves 30A and 30B.

  In order to avoid the occurrence of the above situation, in the remote I / O system 1 according to the present embodiment, when a failure occurs in the CPU 41 of the I / O slaves 30A and 30B, the I / O slaves 30A and 30B. The I / O slaves 30A and 30B have a link-down function in the event of a CPU failure that links itself down and disconnects itself from the networks 3A and 3B.

  As a means for realizing such a CPU failure link-down function, a watchdog timer that counts up at a constant cycle is mounted on the I / O control unit 42 of each I / O slave 30A, 30B. Then, the CPU 41 periodically resets the watchdog timer by transmitting a reset command to the I / O control unit 42 via the bus 40.

  In the case of the present embodiment, writing of sensor information to the memory 43A of the Ethercat (registered trademark) slave controller 43 by the CPU 41 and reading of control information stored in the memory 43A are performed at a cycle of 500 [us]. For this reason, the CPU 41 transmits the above-described reset command to the I / O control unit 42 at a cycle of 1 [ms].

  If the watchdog timer is not reset within a predetermined count value (hereinafter referred to as a set value), the I / O control unit 42 causes a failure (hereinafter referred to as appropriate) to the CPU 41. It is determined that a CPU watchdog timer abnormality has occurred), and the reset signal is continuously transmitted to the first and second PHYs 44A and 44B and the Ethercat (registered trademark) slave controller 43. As a result, the first and second PHYs 44A and 44B and the Ethercat (registered trademark) slave controller 43 that have received the reset signal continuously execute reset processing, and the first and second PHYs 44A and 44B By interrupting communication with the slave, the I / O slaves 30A and 30B are disconnected from the networks 3A and 3B.

  In addition, the I / O control unit 42 sends the operation LED 46 that has been lit up to that time together with the transmission of the reset signal to the first and second PHYs 44A and 44B and the Ethercat (registered trademark) slave controller 43 as described above. By turning off the light and turning on the failure LED 47 that has been turned off, the fact that a failure has occurred is displayed.

  The return from link down of the I / O slaves 30A and 30B is performed by the system administrator after repairing the I / O slaves 30A and 30B or after replacement with the new I / O slaves 30A and 30B. This is realized by restarting or starting the slaves 30A and 30B.

  FIG. 4 shows a processing procedure of CPU down link down processing executed by the I / O control unit 42 of the I / O slaves 30A and 30B in relation to the above CPU down link down function. When the mounting I / O slaves 30A and 30B are activated, the I / O control unit 42 starts the CPU down link down process shown in FIG. 4, and first resets the count value of the watchdog timer ( SP1) Thereafter, the count by the watchdog timer is started (SP2).

  Subsequently, the I / O control unit 42 increments the count value of the watchdog timer by 1 (SP3), and then determines whether or not a reset command from the CPU 41 has been received (SP4). When the I / O control unit 42 obtains a positive result in this determination, the I / O control unit 42 returns to step SP1, and thereafter repeats step SP1 and subsequent steps in the same manner.

  On the other hand, if the I / O control unit 42 obtains a negative result in the determination at step SP4, the I / O control unit 42 refers to the count value of the watchdog timer at that time and determines whether or not the count value exceeds the set value. Is determined (SP5). When the I / O control unit 42 obtains a positive result in this determination, the I / O control unit 42 returns to step SP3, and thereafter repeats the above-described processing.

  On the other hand, if the I / O control unit 42 obtains a negative result in the determination at step SP5, the I / O control unit 42 continuously sends a reset signal to the first and second PHYs 44A and 44B and the Ethercat (registered trademark) slave controller 43. By continuing to transmit, the I / O slaves 30A and 30B are linked down, the operation LED 46 is turned off, and the failure LED 47 is turned on (SP6). Then, the I / O control unit 42 thereafter ends the CPU failure link down process.

  On the other hand, FIG. 5 is executed in the remote I / O system 1 when a CPU watchdog timer abnormality occurs in any of the I / O slaves 30A, 30B on the A-system or B-system networks 3A, 3B. The flow of a series of processing is shown.

  In the remote I / O system 1, when a CPU watchdog timer abnormality occurs in any of the I / O slaves 30A and 30B, as described above, the I / O slave (hereinafter referred to as a CPU fault I / O slave). 30A and 30B link down and disconnect themselves from the networks 3A and 3B (SP10). When the CPU failure I / O slaves 30A and 30B link down, the slaves on both sides detect the link down and start loopback processing (SP11).

  When the slaves on both sides of the CPU failure I / O slaves 30A and 30B start the loopback process, the masters of the A-system or B-system networks 3A and 3B (the first or second control devices 2A and 2B first) 1 or the second master CPU 11A, 11B, 12A, 12B) detects the link-down of the CPU failure I / O slaves 30A, 30B. For example, the CPU failure I / O slaves 30A, 30B detect the AI slaves 26A, 26B and DI In the case of the slave 28A, 28B, the sensor information is acquired so as to obtain the sensor information from the corresponding AI slave 26B, 26A or DI slave 28B, 28A of the network 3B, 3A of the other system (B system or A system). The acquisition source is switched (SP12).

  Thereafter, after the CPU failure I / O slaves 30A and 30B are repaired or replaced with normal I / O slaves 30A and 30B by the system administrator, the I / O slaves 30A and 30B are restarted or started. Then, the communication between the I / O slaves 30A, 30B and the slaves on both sides thereof is started by the hot connect function of Ethercat (registered trademark) (SP13), and thereafter, this series of processing ends.

(4) Effect of this Embodiment As described above, in the remote I / O system 1 of this embodiment, the first and second control devices 2A and 2B are provided as master devices, and the first and second control devices are provided. The same processing is always performed in the control devices 2A and 2B, and only the first control device 2A set as the main system among the first and second control devices 2A and 2B transmits the periodic frame to the A system and the B system. Transmit to networks 3A and 3B, respectively. When a failure occurs in the first control device 2A set as the main system, the master-slave switching unit 4 switches the master-slave of the first and second control devices 2A, 2B, and the second control device 2B. Operates as the main system.

  In this remote I / O system 1, the networks (system A and system B 3A, 3B) are also duplicated, and even if one of the networks 3A, 3B fails, it is set as the main system. In the 1st or 2nd control apparatus 2A, 2B, the production | generation of the control information using the sensor information acquired from the other networks 3A, 3B is performed.

  Therefore, according to the remote I / O system 1, when a failure occurs in the first control device 2A set as the main system, or when either the A system or the B system network 3A, 3B fails. Even when it occurs, the entire system can continue processing without any problem, and a highly reliable communication system can be constructed.

  Further, in the remote I / O system 1, when an abnormality occurs in the CPU watchdog timer in the I / O slaves 30A and 30B, the I / O slaves 30A and 30B are linked down by themselves so as to connect themselves from the networks 3A and 3B. Separate.

  Therefore, in the remote I / O system 1, especially when a failure occurs in the CPU 41 of the AI slaves 26A, 26B and the DI slaves 28A, 28B, the old sensor information is transferred to the first or second control device 2A, 2B. It is possible to effectively prevent the controlled object at the remote site from being controlled based on the old sensor information transmitted.

  Note that the CPU watchdog timer abnormality of the I / O slaves 30A and 30B can be monitored by a process data interface (PDI) watchdog timer function adopted in the Ethercat (registered trademark) standard.

  However, according to this method, the master (first or second master of the first or second control device 2A, 2B) is notified after the interrupt defined on the fixed period frame of Ethercat (registered trademark) is notified. CPU 11A, 12A, 11B, 12B) performs a bus scan to detect which I / O slave 30A, 30B has an abnormality in the process data interface watchdog timer. The master (the first or second master CPU 11B, 12B, 11A, 12A of the second or first control device 2B, 2A) has an abnormal process data interface watchdog timer in any I / O slave 30A, 30B Cannot be detected.

  Therefore, by using the CPU watchdog timer function as in the present embodiment instead of the process data interface watchdog function, it is possible to effectively prevent the occurrence of defects caused by control using old sensor information. Therefore, a more reliable remote I / O system can be constructed.

(5) Other Embodiments In the above-described embodiment, the case where the present invention is applied to a remote I / O system for a gas turbine power plant configured as shown in FIG. 1 has been described. The present invention is not limited to this, and can be widely applied to various other uses and other remote I / O systems having various configurations.

  In the above-described embodiment, the I / O slaves 30A and 30B monitor the CPU 41 (FIG. 3), and when a failure of the CPU 41 is detected, the first and second PHYs 44A are prevented from communicating with the outside. 44B is installed in the I / O control unit 42 that controls the sensor output input processing of the corresponding sensor and the control information output processing to the corresponding control target. Although the case has been described, the present invention is not limited to this, and a device having a function as the processor monitoring unit may be provided separately from the CPU 41 and the I / O control unit 42.

  The present invention can be widely applied to remote I / O systems having various configurations.

DESCRIPTION OF SYMBOLS 1 ... Remote I / O system, 2A, 2B ... Control apparatus, 3A, 3B ... Network, 4 ... Master-slave switcher, 10A, 10B ... Main CPU, 11A, 11B, 12A, 12B ... Master CPU , 20A, 20B, 21A, 21B ... Switching hub, 22A-25A, 22B-25B ... Media converter, 26A, 26B ... AI slave, 27A, 27B ... AO slave, 28A, 28B ... DI slave, 29A 29B ... DO slave, 30A, 30B ... I / O slave, 31 ... signal distributor, 41 ... CPU, 42 ... I / O control unit, 43 ... Ethercat (registered trademark) slave controller, 44A, 44B ... PHY.

Claims (9)

In a communication system to which a master-slave communication protocol is applied,
Multiple master devices;
A plurality of networks each having a ring-type network topology connected to each of the master devices and connected to one or more slave devices;
A master-slave switching unit that sets any one of the master devices as a master system, sets the other master device as a slave system, and switches the master-slave of the master device as necessary,
The master device set to the master system transmits a communication frame of a predetermined format to each network and the master device set to the slave system,
Each of the slave devices connected to each of the networks reads and writes information in an area allocated to itself in the communication frame,
The master device set as the main system performs the necessary arithmetic processing based on the information written in the communication frame by the corresponding slave device, and stores the information obtained by the arithmetic processing in the corresponding location. Generate a communication frame, and transmit the generated communication frame to each of the networks and the master device set in another system,
The communication system, wherein the master / slave switcher switches between a master system and a slave system of the master device when a failure occurs in the master device set as a master system. Some or all of the slave devices
A receiving unit for receiving the communication frame flowing through the network;
A slave controller that writes the information in an area allocated to the communication frame received by the receiving unit;
A transmission unit for transmitting the communication frame in which the information is written by the slave controller to the network;
A processor for providing the slave controller with the information to be written to the communication frame;
A processor monitoring unit for monitoring the processor,
The processor monitoring unit
The communication system according to claim 1, wherein the presence or absence of a failure of the processor is monitored, and when the failure of the processor is detected, the reception unit and the transmission unit are controlled to link down. The processor monitoring unit
The communication system according to claim 2, wherein the reception unit and the transmission unit are controlled to link down by continuously transmitting a reset signal to the reception unit and the transmission unit. The processor monitoring unit
The communication system according to claim 2, wherein the communication system is an FPGA (Field-Programmable Gate Array) that controls input / output of the information given from outside. The processor monitoring unit is equipped with a watchdog timer,
The processor periodically resets the watchdog timer,
The communication system according to claim 2, wherein the processor monitoring unit monitors whether or not the processor is faulty based on a count value of the watchdog timer. A communication control method in a communication system to which a master-slave communication protocol is applied,
The communication system is:
Multiple master devices;
A plurality of networks each having a ring-type network topology connected to each of the master devices and connected to one or more slave devices;
A master-slave switching unit that sets any one of the master devices as a master system, sets the other master device as a slave system, and switches the master-slave of the master device as necessary,
The master device set to the master system transmits a communication frame of a predetermined format to each network and the master device set to the slave system,
Each of the slave devices connected to each of the networks reads and writes information in an area allocated to itself in the communication frame,
The master device set as the main system performs the necessary arithmetic processing based on the information written in the communication frame by the corresponding slave device, and stores the information obtained by the arithmetic processing in the corresponding location. Generate a communication frame, and transmit the generated communication frame to each of the networks and the master device set in another system,
The master-slave switcher, when a failure occurs in the master device set as a master, a first step of switching between the master and slave of the master device;
The master device newly set as the main system executes necessary arithmetic processing based on the information written in the communication frame by the corresponding slave device, and stores the information obtained by the arithmetic processing in the corresponding location. And a second step of transmitting the generated communication frame to each of the networks and the master device set to another system. Some or all of the slave devices
A receiving unit for receiving the communication frame flowing through the network;
A slave controller that writes the information into the communication frame received by the receiver;
A transmission unit for transmitting the communication frame in which the information is written by the slave controller to the network;
A processor for providing the slave controller with the information to be written to the communication frame;
A processor monitoring unit for monitoring the processor;
A monitoring step in which the processor monitoring unit monitors whether or not the processor is faulty;
The communication control method according to claim 6, further comprising: a control step of controlling the receiving unit and the transmitting unit so that a link down occurs when the processor monitoring unit detects a failure of the processor. In the control step, the processor monitoring unit includes:
The communication control method according to claim 7, wherein the reception unit and the transmission unit are controlled to link down by continuously transmitting a reset signal to the reception unit and the transmission unit. The processor monitoring unit is equipped with a watchdog timer,
The processor periodically resets the watchdog timer,
In the monitoring step, the processor monitoring unit includes:
The communication control method according to claim 7, wherein the presence or absence of a failure of the processor is monitored based on a count value of the watchdog timer.

Images