JP2016024798A - Redundant controller system and standby system controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To safely perform the debug of an update version program on an actual machine during an operation in a redundant PLC system.SOLUTION: A standby system controller 10B to which an update version PLC program 15b has been downloaded executes the PLC program 15b by using input data 16 such as equalized data to obtain output data 18. Then, an output check function part 19 compares and checks the output data 18 and output data 17 of the equalized data to detect a matching part and a mismatching part.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a redundant programmable controller system.

  In the plant field where the facility cannot be stopped, when it is desired to change the user application in a redundant (redundant) programmable controller system, for example, the following method has been adopted.

FIG. 4 is a configuration example of a conventional redundant programmable controller system.
The redundant (redundant) system in the illustrated example is provided with two programmable controllers 100A and 100B, and operates one as an active system and the other as a standby system. When the active system controller fails, the standby system controller operates as a new active system controller. In the illustrated example, the controller 100A is an active system and the controller 100B is a standby system.

  Each of the programmable controllers 100A and 100B has the same configuration, and includes a program memory 105 and various functional units such as an input function unit 101, an arithmetic function unit 102, an output function unit 103, and an equalization function unit 104. doing. However, in the standby controller 100B, only the equalization function unit 104 operates, and the input function unit 101, the calculation function unit 102, and the output function unit 103 do not operate.

  The active system controller 100 </ b> A controls a control target device (not shown) via the input module 121 and the output module 122. This is executed by executing a PLC (Programmable Logic Controller) program 105a, which is various control programs.

  Here, the program memory 105 stores the PLC program 105a. The PLC program 105a is generated by the support loader 110 and downloaded to the controllers 100A and 100B. Basically, the same PLC program is stored in the two controllers 100A and 100B. However, when a program is updated, there is a case where a new program which is an updated version is temporarily stored on one side and an old program is stored on the other side.

  In the support loader 110, the programmer creates an arbitrary application program 111 and compiles the application program 111 to generate the PLC program 112. The application program 111 may be updated (version upgrade or the like), and each time it is updated, a new PLC program 112 is generated by compile processing and downloaded to the controller 100. However, in order to execute this during operation, a method described later has been conventionally used. Details will be described later.

Here, FIG. 5 shows an operation example of each controller 100 of the active system and the standby system.
Each controller 100 repeatedly executes a predetermined process in a predetermined cycle. First, the standby system controller 100B executes only equalization processing for each cycle as shown in the figure.

  On the other hand, the active system controller 100A executes a series of processes of “input → calculation → input / output data equalization → output” for each cycle. First, the input process is a process in which the input function unit 101 acquires the input data 106 from the various input modules 121. The input data 106 is, for example, temperature, humidity, pressure, rotation speed, count value, etc. related to the control target device. The calculation process is a process in which the calculation function unit 102 generates the output data 107 by executing the PLC program 105 a using the input data 106.

  The input / output data equalization process is a process in which the equalization function unit 104 transfers the input data 106 and the output data 107 to the standby controller 100B. The equalization processing of the standby controller 100B is processing for receiving the transferred input data 106 and output data 107 and storing them in a storage area (not shown).

The output process is a process in which the output function unit 103 outputs the generated output data 107 to the various output modules 122.
Here, as described above, the PLC program may be updated (version upgrade, etc.) during operation. For example, as shown in FIG. 6, the program creation support function of the support loader 110 causes the programmer to arbitrarily create a new application program 111b that is an updated version of the application program 111. A PLC program (update program) 112b is generated by compiling the new application 111b by the compiling function of the support loader 100.

Thereafter, the controller 100 downloads and operates the PLC program (update program) 112b. However, such an operation to change the control program of the controller 100 to a new program must be performed during operation, and the operation check of the new program cannot be performed in advance, so a method of operating without debugging is employed. It was. That is, for example, the method described below with reference to FIGS.
(1) As shown in FIG. 6, the PLC program (update program) 112b generated as described above in the support loader 110 is downloaded to the standby controller 100B. The standby controller 100B stores the PLC program (update program) 112b in the program memory 105 as a new PLC program (update program) 105b.
(2) As shown in FIG. 7, the support loader 110 instructs the controller 100 to switch operation / standby. In response, the controller 100A switches to the standby system, and the controller 100B switches to the operation system. As a result, as shown in FIG. 8, the controller 100B, which has become an active system, performs control by executing the new PLC program (update program) 105b. In other words, the new application is actually operated to check whether there is any problem.
(3) If the user determines that there is any problem in the operation of the new user application, the support loader 110 issues an operation / standby switching instruction to the controller 100 again by an instruction operation by the user. As a result, as shown in FIG. 9, the controller 100A again operates as an active system. Of course, the controller 100A is operated by the PLC program 105a (old version) before update.
(4) On the other hand, if the user determines that there is no problem in the operation of the new user application, as shown in FIG. 10, the active controller 100B is operated as it is and the support loader 110 is put on standby by the user's instruction operation. The new PLC program (update program) 112b is downloaded to the system controller 100A. Accordingly, the standby controller 100A stores the PLC program (update program) 112b in the program memory 105 as the PLC program (update program) 105b.

  In this way, when the program is changed, it is a system in which the operation cannot be temporarily stopped and the operation can be confirmed. Therefore, in the past, the operation is actually confirmed during the operation and the operation is substantially confirmed. , Trying to minimize the negative effects by immediately reverting any problems.

Further, for example, the prior art described in Patent Document 1 is known.
The invention of Patent Document 1 can sufficiently verify the reliability of the created user program, and when an inconvenient point is found in the created user program, the old program can be easily restored at any time. The present invention provides a duplexed PLC that can be used.

  In Patent Document 1, a third setting state corresponding to a duplex mode having no hot standby function is provided as a setting state in the operation mode setting means. In addition, there is provided third operation state realization means that is activated on condition that the operation mode setting means is in the third setting state, and that realizes a duplex operation state that does not have a hot standby function. Further, when switching from the second setting state to the third setting state, the user program data is not transferred from the CPU unit in the inactive state to the CPU unit in the active state prior to the start of the duplex operation state. .

JP 2009-32100 A

  In a programmable controller system that cannot be stopped by the above-mentioned conventional method, when updating a PLC program (user program / control program), the operation check of the updated version of the new program is realized by actually operating it during operation. I was letting. For this reason, if there is any problem in the new program, it may be a short time, but there may be some abnormality in the operation of the control target device.

  It is an object of the present invention to check the operation of a new program while not affecting the operation of the controlled device even if there is any problem in the new program when updating a user program in a PLC redundancy system. To provide a redundant controller system and the like that can be performed on a real system.

The redundant controller system of the present invention has an active system controller and a standby system controller each holding a control program, and the active system controller controls a control target device using the control program held by itself. In addition, the redundant controller system transfers equalized data including input data and output data related to execution of the control program to the standby controller, and the standby controller has the following configurations.
Simulation execution means for obtaining output data by executing the updated program using the input data of the equalized data when an updated version of the control program is acquired;
A result check means for comparing the output data obtained by the simulation execution means with the output data of the equalized data and detecting a coincidence portion or a disagreement portion:

  According to the redundant controller system and the like of the present invention, in the PLC redundant system, even if there is any problem in the new program when updating the user program, the operation of the control target device is not affected. You can check the operation of the new program on the actual system.

It is a functional block diagram of the redundant controller system of this example. It is a figure which shows schematic operation | movement of the redundant controller system of this example. It is a figure which shows an example of a comparison check result. It is a structural example of the conventional redundant programmable controller system. It is a figure which shows the operation example of each controller of an active system and a standby system. It is the operation | movement at the time of the conventional application update (the 1). This is an operation (No. 2) in conventional application update. It is the operation | movement (the 3) in the case of the conventional application update. This is a conventional operation for determining an abnormality. This is a conventional normal determination operation.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a functional configuration diagram of the redundant controller system of this example.
The redundant controller system of FIG. 1 has two controllers 10A and 10B. In the state shown in the figure, it is assumed that the controller 10A is an active system and the controller 10B is a standby system. Thus, in the following description, the description will be basically made by describing the active system controller 10A, the standby system controller 10B, and the like. However, of course, the controller 10B may be an active system and the controller 10A may be a standby system. Therefore, for example, what is described as the function / operation of the active system controller 10A in the following description may be regarded as having the same function / operation in the controller 10B as the active system. The same applies to the standby system.

  In the illustrated state, the updated version of the PLC program has already been downloaded and held in the standby controller 10B. On the other hand, the operating system controller 10A holds the PLC program (old version) before update. That is, the program storage status is the same as in FIG. However, the operation of each controller 10 is completely different from that in FIG.

The illustrated support loader 20 and the controllers 10A and 10B are connected by a communication line (not shown) so that data can be transmitted and received between them.
The support loader 20 is realized by a general-purpose computer device such as a personal computer. Therefore, although not shown in particular, the support loader 20 has a general configuration such as a personal computer, for example, a CPU (not shown), a storage unit (hard disk, memory, etc.), a communication function unit, a display unit such as a display, etc. And an input operation unit such as a keyboard and a mouse. A predetermined application program is stored in the storage unit in advance, and various processing functions of the support loader 20 are realized by the CPU executing the application program.

  The support loader 20 basically has an existing function as a support device for a programmable controller, but further includes a function for instructing the standby controller to shift to a debug mode to be described later. You can assume that it is. The existing function is, for example, a program creation support function that allows a user (programmer) to arbitrarily create a control program or the like using a ladder diagram or the like, or the created program is compiled and converted into a format that can be executed by a programmable controller. Functions, etc. Since these are existing functions, they will not be described in detail.

  Each controller 10 may also be an existing programmable controller in hardware configuration itself. For example, an arithmetic processor such as a CPU / MPU, a memory, a communication function, an input module 1 connected to the input module 1 or the output module 2. An output interface or the like (both not shown).

  A predetermined application program is stored in advance in the memory (not shown). When the arithmetic processor executes the application program, for example, processing of various functional units illustrated in FIG. 1 is realized. The application program is different from the new application 21 or the like that is a control program or the like.

The functions and operations of the active system controller 10 may be the same as those of the conventional active system controller 100 described above.
That is, each of the controllers 10A and 10B has various function units such as an input function unit 11, an arithmetic function unit 12, an output function unit 13, and an equalization function unit 14. These various function units are the above-described input function units. 101, the calculation function unit 102, the output function unit 103, and the equalization function unit 104 may be basically the same. However, there are some differences as will be described later. For example, when operating in the standby system, the input function unit 11 does not acquire data from the input module 1 but acquires data from the equalized data. Details will be described later.

  Here, the active system controller 10 </ b> A controls a control target device (not shown) via the input module 1 and the output module 2. Of course, for this purpose, the input function unit 11, the calculation function unit 12, and the output function unit 13 are operated.

  On the other hand, the standby controller 10B basically operates only the equalization function unit 14 and does not operate the input function unit 11, the calculation function unit 12, and the output function unit 13. However, in the debug mode described later, the input function unit 11 and the calculation function unit 12 are also operated. However, even in that case, the control target device is not controlled. Details will be described later.

  Further, in the state shown in the figure, the active system controller 10A holds the PLC program 15a shown in FIG. Thus, the arithmetic function unit 12 executes the old PLC program 15a. The arithmetic function unit 12 uses the input data 16 acquired from the various input modules 1 by the input function unit 11 to execute the old PLC program 15a, thereby obtaining output data 17 as a processing result.

  Then, the equalization function unit 14 transfers the input data 16 and the output data 17 to the standby controller 10B. Further, the output function unit 13 outputs the output data 17 to each output module 2, thereby controlling various control target devices (not shown) via the output module 2.

  The operation of the operating system controller 10A as described above is shown in FIG. FIG. 2 also shows the operation of the standby controller 10B in the debug mode described later. Note that, when not in the debug mode, the operation of the standby controller 10B executes only equalization processing, similar to the operation of the conventional standby controller 100B.

The operation of the standby controller 10B in the debug mode is different from the operation of the conventional standby controller 100B as shown in the figure.
In other words, the standby controller 100B conventionally executes only equalization processing for each cycle. However, as shown in FIG. 2, the standby controller 10B performs “equalization input” for each cycle in the debug mode. Each process of “data expansion” → calculation → output data check → data storage is sequentially executed. This will be described below with reference to FIG.

  First, in the standby system controller 10B, only the equalization function unit 14 normally operates as in the conventional case. However, as long as the mode is switched to the debug mode in accordance with an instruction from the support loader 20, operations other than the output function unit 13 operate as shown in FIGS. The standby controller 10B of this example is further provided with an output check function unit 19 shown in addition to the conventional configuration. The output check function unit 19 is also provided in the active system controller 10A, but is not shown in the drawing because it is a functional unit that does not operate in the active system.

The support loader 20 gives an instruction to switch to the debug mode when, for example, a new program is downloaded to the standby controller 10B. However, the present invention is not limited to this example.
When the equalization function unit 14 of the standby system controller 10B receives the equalization data (input data 16 and output data 17) transferred from the active system controller 10A, it expands it on a memory, for example. The input function unit 11 of the standby controller 10B inputs this input data 16 and passes it to the arithmetic function unit 12.

  Here, the program memory 15 of the standby controller 10B stores a PLC program (update program) 15b that is the above-described updated PLC program. Hereinafter, the PLC program (update program) 15b may be referred to as a new program 15b or the like. Similarly, the PLC program (update program) 22 may be referred to as a new program 22 or the like. In addition, the PLC program 15a may be referred to as an old program 15a.

  The calculation function unit 12 executes the new PLC program 15b using the input data 16 and generates output data 18 as a calculation result. However, since the output function 13 is not operating, the output data 18 is not output to the output module 2. That is, the output data 18 does not affect the operation of a control target device (not shown).

For easy identification, the output data 18 may be referred to as standby output data 18 and the equalized data output data 17 may be referred to as operation output data 17 in some cases.
The output check function unit 19 compares the standby-side output data 18 with the operation-side output data 17 to detect a match / mismatch location. That is, the results calculated by the old program 15a and the new program 15b using the same input data 16 are compared, and a matching part and a mismatching part are detected. Normally, the new program 15b includes a program portion that is a part of the old program 15a modified / deleted or added.

  The output check function unit 19 stores the check result in a memory or a memory card (not shown). For example, as shown in FIG. 3, the output data value on the active system side, the output data value on the standby system side, and the coincidence / non-coincidence information corresponding to each data name (or output address) are listed. Save in CSV format for display. The check result is transferred to, for example, the support loader 20 and displayed on the display of the support loader 20.

  If the programmer who created the new application 21 refers to this display, it can be determined whether there is a problem in the operation of the new program 15b. That is, such a programmer should be able to grasp the difference between the new program 15b and the old program 15a, and should be able to determine where the output data should match and where the output data should match. Alternatively, the output data value may be predictable. Thus, for example, it may be possible to check whether the corrected part has been changed properly.

  If it is determined that there is no abnormality in the operation of the new program 15b, for example, the support loader 20 instructs the controller 10 to switch operation / standby in accordance with a designation operation from the programmer. Thus, the controller 10B operates as an active system, but of course, the controller 10B operates using the new program 15b. Furthermore, the support loader 20 may download the new program 22 to the controller 10A as in the conventional FIG. The controller 10A that has become the standby system stores the new program 22 in its own program memory 15, and the old program 15a is erased accordingly.

  As a result, if the controller 10A becomes active due to operation / standby switching because some abnormality has occurred in the active controller 10B later, the controller 10A can take over the processing without any problem using the new program. .

  Note that, as shown in FIG. 2, the standby controller 10B can determine whether the output data does not match or not by calculating a new user application with a delay of one cycle from the operating controller 10A.

  As described above, in this method, during operation, the active controller downloads the new program to the standby controller and executes the simulated operation while the operation continues with the old program. The simulated operation may be substantially the same as the normal operation except that the input data is acquired from the active system controller and the calculation result (output data) is not output to the output module 2. Then, by comparing the operation result (output data) with the operation result (output data) of the active controller that has been executed using the same input data, it is possible to determine whether there is a problem with the new program.

  In this way, in this method, the new program can be debugged using actual input data on the actual machine, and the operation result is not output to the output module 2, so that there is some problem in the new program. However, it does not adversely affect the operation of the controlled device.

  In this method, the standby controller uses the equalized data (its input data) to operate the calculation function of the new program in a specific mode (debug mode). Use for checking without output. In other words, the calculation result is compared and checked with the output data of the equalized data (the calculation result of the old program on the operating side), the coincidence portion and the non-coincidence portion are determined, and the determination result is stored.

  The stored match / mismatch determination result is transferred to the support device and displayed, for example, to allow the programmer to determine whether there is an abnormality in the new program (check whether the new program is operating correctly) . Since the calculation result is not output to the controlled device, even if there is any problem in the new program, the operation of the controlled device is not adversely affected.

  Normally, a standby controller that does not execute an application simulates the updated application based on actual input data in the debug mode after acquiring the updated application. Simulated means that the device to be controlled is not actually controlled as the application is executed. Further, the updated application execution result (output data) is compared with the execution result (output data) of the old application by the active controller. The input data is the same. In this way, the operation check of the updated application program in the redundant controller system can be performed safely.

  Although one embodiment of the present invention has been described above, other embodiments are conceivable for the present invention. For example, in the redundant controller system in the above embodiment, a PLC is used as a control device that controls a device by executing a program. However, a DCS (Distributed Control System) is a control device. It may be used as This DCS has higher reliability than the PLC. While PLC is generally applied to FA or the like, DCS is applied to plant equipment or the like that requires high reliability. The present invention may be applied to a control system that uses this DCS as a control device.

1 Input Module 2 Output Module 10 (10A, 10B) Controller 11 Input Function Unit 12 Arithmetic Function Unit 13 Output Function Unit 14 Equalization Function Unit 15 Program Memory 15a Old PLC Program 15b New PLC Program 16 Input Data 17 Output Data 18 Output Data 19 Output check function unit 20 Support loader 21 New application 22 PLC program (update program)

Claims (5)

Each has an active system controller and a standby system controller that holds a control program, and the active system controller controls a control target device using a control program that it holds and is involved in execution of the control program A redundant controller system for transferring equalized data including input data and output data to the standby controller,
The standby controller is
Simulation execution means for obtaining output data by executing the updated program using the input data of the equalized data when the updated version of the control program is acquired;
A result check means for detecting the coincidence portion or the disagreement portion by comparing the output data obtained by the simulation execution means with the output data of the equalized data;
A redundant controller system comprising:   The redundant controller system according to claim 1, wherein the standby controller does not output the output data obtained by the simulation execution unit to the control target device. And further comprising a support device having a program creation support function for arbitrarily creating the control program and its updated version,
3. The redundant controller system according to claim 1, wherein a result of coincidence or mismatch detection by the result check unit is transferred to the support device and displayed on the support device. The support device issues a switching instruction to the controller in accordance with a predetermined operation when it is determined that there is no abnormality in the updated program based on the display,
4. The redundant controller according to claim 3, wherein the active system controller is switched to a standby system in response to the switching instruction, and the standby system controller is switched to the active system and starts a control operation by the updated version program. system. Each has an active system controller and a standby system controller that holds a control program, and the active system controller controls a control target device using a control program that it holds and is involved in execution of the control program The standby controller in a redundant controller system for transferring equalized data including input data and output data to the standby controller,
Simulation execution means for obtaining output data by executing the updated program using the input data of the equalized data when the updated version of the control program is acquired;
A result check means for detecting the coincidence portion or the disagreement portion by comparing the output data obtained by the simulation execution means with the output data of the equalized data;
A standby controller of a redundant controller system, comprising: