JP2021105774A - Controller and facility monitoring system - Google Patents

Abstract

To provide a reliable facility monitoring system capable of efficiently switching from an active state to a standby state.SOLUTION: A controller in a facility monitoring system which is provided with a monitoring device and duplexed controllers includes an I/F for performing communication between the controllers and a DO/DI terminal for transmitting/receiving signals between the controllers, and determines a failure state of other controller on the basis of the transmission/reception of a message between the controllers and the transmission/reception of a signal using the DO/DI terminal. When the controller in the standby state has determined that the controller in the active state has failed on the basis of the message between the controllers, the controller is switched to the active state. When the controller in the standby state has determined that the controller in the active state has failed on the basis of the signal using the DO/DI terminal and has determined that the controller in the active state is normal on the basis of the message between the controllers, the switching to the active state is not performed.SELECTED DRAWING: Figure 3A

Description

The present invention relates to duplication of a controller in a facility monitoring system that manages equipment installed in facilities such as buildings and plants.

A facility monitoring system that manages equipment installed in facilities such as buildings and plants consists of a controller that collects monitoring data for equipment and a monitoring device that centrally manages the controllers via a network (for example). , See Non-Patent Document 1.).

If an error occurs in this controller, it will not be possible to collect monitoring data from equipment, so controller redundancy technology will be used to continuously collect monitoring data and provide a highly reliable facility monitoring system. Has been proposed.

In the proposed redundancy technology, two controllers, an active controller and a standby controller, are prepared, and if the active controller fails, the controller is switched to the standby controller (for example, a patent). Refer to Documents 1 and 2.)

Japanese Patent No. 3882783 Japanese Patent No. 4836979

Takayoshi Koyanagi, et al. "Development of new engineering tools that contribute to the efficiency of engineering work of building automation systems", azbil Technical Review, 2017-04

In such a redundant technology, in order to provide a highly reliable facility monitoring system, a technology for determining a stable controller failure state and efficiently switching from an active controller to a standby controller is required. ing.

Since the determination of the failure state of the communication unit and the switching of the communication unit in Patent Document 1 are performed by the CPU unit connected to both the communication unit in the active mode and the communication unit in the standby mode, the CPU unit is used for switching the communication unit. Intervention is required, and rapid switching of communication units may not be performed.

In Patent Document 2, the failure state is determined by reading the failure state with the tracking cable connected between the control system controller and the standby system controller, but the failure state is transmitted and received by the tracking cable. Therefore, if an abnormality occurs in the cable, the failure status of other controllers may become unknown.

The present invention has been made to solve such a problem, and can efficiently determine a stable controller failure state and switch from an active controller to a standby controller, and is reliable. The purpose is to provide a high-quality facility monitoring system.

In order to achieve such an object, the controller according to the present invention is a controller in a facility monitoring system including a monitoring device and a redundant controller, and is a first controller for communicating with the monitoring device. I / F, a second I / F for communicating between the duplicated controllers, a DO / DI terminal for transmitting and receiving signals between the duplicated controllers, and the duplicated The failure determination unit and the determination result of the failure determination unit determine the failure status of the other controller based on the transmission / reception of a message using the second I / F and the transmission / reception of a signal using the DO / DI terminal. Based on this, a switching processing unit that switches between a standby state and an active state is provided, and in the standby state, the controller in the active state fails based on a message using the second I / F. When the determination is made, the switching processing unit switches to the active state, and the failure determination unit is in the active state based on the signal using the DO / DI terminal in the standby state. When it is determined that the controller is out of order and it is determined that the controller in the active state is normal based on the message using the second I / F, the switching processing unit switches to the active state. May be configured not to do.

Further, the failure determination unit may be configured to determine the failure state using the DO / DI terminal based on whether or not the pulse signal transmitted by the other duplicated controller can be detected. ..

Further, the failure determination unit is configured to determine the failure state using the second I / F based on whether or not a message corresponding to the message transmitted to the other duplicated controller has been received. You may.

In order to achieve such an object, the facility monitoring system according to the present invention includes the controller described above.

According to the present invention, it is possible to efficiently switch from the controller in the active state to the controller in the standby state, and it is possible to provide a highly reliable facility monitoring system.

FIG. 1A is a diagram showing a configuration example of a setting management system according to an embodiment of the present invention. FIG. 1B is a diagram for explaining the operation of the “active state” and the “standby state” in the embodiment of the present invention. FIG. 2A is a configuration example of the controller according to the embodiment of the present invention. FIG. 2B is a configuration example of a computer constituting the controller according to the embodiment of the present invention. FIG. 3A is a diagram for explaining a failure determination of the controller according to the embodiment of the present invention. FIG. 3B is a diagram for explaining a failure determination condition of the controller according to the embodiment of the present invention. FIG. 4A is a diagram for explaining failure determination by "failure DO monitoring" in the embodiment of the present invention. FIG. 4B is a diagram for explaining a failure determination by "failure DO monitoring" in the embodiment of the present invention. FIG. 4C is a diagram for explaining failure determination by "lower Ethernet line monitoring" in the embodiment of the present invention. FIG. 5A is a diagram for explaining switching control of the “main controller” according to the embodiment of the present invention. FIG. 5B is a diagram for explaining switching control of the “subordinate controller” according to the embodiment of the present invention. FIG. 6A is a diagram for explaining data synchronization (constant synchronization) in the embodiment of the present invention. FIG. 6B is a diagram for explaining data synchronization (initial synchronization) in the embodiment of the present invention.

Embodiments of the present invention will be described with reference to the drawings. The present invention can be implemented in various embodiments and is not limited to the embodiments described below.

<Overview of duplex configuration>
FIG. 1A is a diagram showing a configuration example of a facility monitoring system according to an embodiment of the present invention. The facility monitoring system 1 includes a redundant main controller 30, a slave controller 40, a monitoring device 10 that monitors equipment via the controller, an engineering tool 20 that makes various settings for the controller, and equipment for connecting the equipment. It is composed of a plurality of I / O modules (50-1 to 50-4). In this embodiment, the communication between the monitoring device 10, the controller (30, 40), and the I / O module (50-1 to 50-4) uses the BACnet (Building Automation and Control Protocol) protocol. It is done using.

In the configuration example of FIG. 1A, the main controller 30, the slave controller 40, the monitoring device 10, and the engineering tool 20 are connected by an upper Ethernet (registered trademark) line 60, and the main controller 30, the slave controller 40, The I / O modules (50-1 to 50-4) are connected by lower Ethernet lines (70-1, 70-2). The main controller 30 and the slave controller 40 are configured to transmit and receive a failure DO (Digital Output) signal to and from each other.

In the present embodiment, the failure DO monitoring between the controllers and the lower Ethernet line monitoring are used to determine the failure state of other controllers facing each other, and the active state and the standby state are switched based on the determination result.

Normally, the main controller is in the "active state" and the slave controller is in the "standby state", but when the main controller fails and control is not possible, the slave controller is switched to the "active state". When the main controller recovers from the failure, the slave controller switches to the "standby state" again, and the main controller switches to the "active state".

<Duplicate method>
The duplication method in the present embodiment is a combination method of a "dual system" and a "duplex system". The "dual system" is a system in which two controllers are always made to perform the same operation, and even if one controller fails, the processing by the other controller can be continued. On the other hand, the "duplex system" is a system composed of a main controller that is always in operation and a slave controller that is on standby, and the slave controller takes over the processing when the main controller fails.

<Operation in active state and standby state>
FIG. 1B is a diagram for explaining the operation of the “active state” and the “standby state” in the embodiment of the present invention. The internal control operation in each controller, I / O module communication, and data scan in I / O module communication are defined as "dual system" so that even if the main controller fails, the processing can be quickly taken over by the slave controller. To.

On the other hand, the output control and data notification from the controller will be referred to as the "duplex system". Output control and data notification from the "standby" controller are suppressed. The controller in the "standby state" suppresses output control and data notification, and releases these suppressions only when the controller in the "active state" fails and switches to the "active state". Prevent heavy output control and data notification.

<Synchronization of data and control status>
The controller in the "active state" and the controller in the "standby state" share the setting data regarding the parameter setting and the command operation from the monitoring device 10 in order to take over the processing promptly. In addition, regarding the operation of the control application in each controller, the execution timing is synchronized between the controller in the "active state" and the controller in the "standby state", and the control state is maintained even when the "active state" is switched to the "standby state". It is configured so that there is little deviation.

<Concealment of duplicate configuration>
In the duplicated controller of the present embodiment, it is possible to set two IP addresses, a virtual IP address (first address) and a physical IP address (second address) for communicating with the monitoring device 10. , The concealment of the duplicated configuration as seen from the monitoring device 10 is realized. As the virtual IP address, an IP address common to the main controller and the slave controller is set, and it can be dynamically enabled / disabled. The virtual IP address is valid and available only on the controller in the "active state", and is configured to enable / disable the virtual IP address according to the switching between the "active state" and the "standby state". ..

Virtual IP addresses are normally disabled and are only valid on controllers in the "active state". By switching the virtual IP address between valid and invalid according to the switching of "active state" / "standby state", the monitoring device even when the slave controller 40 is switched to the "active state" operation. When viewed from 10, it always looks like the same controller is working. By accessing the monitoring device 10 with a virtual IP address common to the main controller 30 and the slave controller 40, it is possible to access without being aware of which of the main controller and the slave controller is in the "active state". can.

When accessing the main controller and the slave controller individually, the unique physical IP address assigned to each of the main controller and the slave controller is used. The engineering tool 20 can use this physical IP address to engineer each controller.

<Controller configuration>
FIG. 2A is a configuration example of the controller according to the embodiment of the present invention. The controller 30 mainly controls the monitoring and control of equipment using parameter settings and command operations from the monitoring device 10 and notifies data to the monitoring device 10, and I / O that controls the I / O module. The control unit 32, the data synchronization unit 33 that synchronizes data between controllers, the switching processing unit 34 that switches controllers, and the failure determination unit 35 that determines the failure of the opposite controller, the I / F unit 36, and the storage unit 37. It is composed of. The slave controller 40 also has a similar configuration.

The I / F unit 36 includes a first I / F (36-1) that supports an upper Ethernet line 60 for communicating with the monitoring device 10 and a lower Ethernet line (36-1) for communicating with the controller and the I / O module. A second I / F (36-2) that supports 70-1, 70-2), and a DO (Digital Output) terminal (36-) for transmitting and receiving a failure DO signal for monitoring the failure of the opposing controller. 3) and DI (Digital Input) terminal (36-4) are provided.

The monitoring control unit 31, the I / O control unit 32, the data synchronization unit 33, the switching processing unit 34, the failure determination unit 35, the I / F unit 36, and the storage unit 37 of the controller 30 are, for example, a CPU (Central Processing Unit). , A computer equipped with a storage device and an external interface (hereinafter referred to as an external I / F), and a program for controlling these hardware resources. A configuration example of such a computer is shown in FIG. 2B.

The computer 100 includes a CPU 200, a storage device 300, and an external I / F 400, which are connected to each other via an I / O interface 500. The program for performing failure determination and switching processing of the present embodiment, the setting data from the monitoring device 10, the data collected from the I / O module, and the like are stored in the storage device 300 and monitored via the external I / F 400. Other computers such as equipment and engineer tools are connected. The CPU 200 executes the process described in the present embodiment according to a program or the like stored in the storage device 300.

In the I / F unit 36, two IP addresses, a common virtual IP address for the upper Ethernet line and a unique physical IP address, can be set. As a result, the duplication configuration is concealed from the monitoring device 10. In the I / F unit 36, the virtual IP address can be dynamically switched between valid and invalid. The virtual IP address is valid and can be used only in the controller in the "active state", and the virtual IP address is enabled / disabled according to the switching between the "active state" and the "standby state". The virtual IP address and the physical IP address can be supported as the same network segment and share the same UDP / TCP port.

By concealing the duplicated configuration by using the virtual IP address in this way, the monitoring device can always access one controller without being aware of the active / standby state of the main controller / slave controller. The monitoring device does not need to have a special function to determine which of the main controller and the slave controller is in the active state, and it is possible to efficiently perform monitoring control such as parameter setting and command operation from the monitoring device. It is possible to realize a possible facility monitoring system.

<Active / standby switching operation>
FIG. 3A is a diagram for explaining a failure determination of the controller according to the embodiment of the present invention. The main system / slave controller determines the failure of the opposite controller or recovery from the failure, and switches between the active state and the standby state based on the determination result. In the present embodiment, two routes of "failure DO monitoring" and "lower Ethernet line monitoring" are used for failure determination for switching operation of active / standby state.

<Detecting the status of the opposite controller and determining failure / recovery>
FIG. 3B is a diagram for explaining a failure determination condition of the controller according to the embodiment of the present invention.

When the opposite controller recognizes that it is "failed" and detects the "normal" state of the opposite controller through the two routes of "failure DO monitoring" and "lower Ethernet line monitoring", it returns to the "normal" state. Judge. For example, the slave controller in the "active state" switches to the "standby state".

On the other hand, when the opposite controller recognizes that it is "normal" and detects the "failure" of the opposite controller by either of "failure DO monitoring" and "lower Ethernet line monitoring", in principle. Determines that the opposite controller has transitioned to the "failure" state. For example, the slave controller switches from the "standby state" to the "active state".

Here, when it is determined that the state of the opposite controller by "Failure DO monitoring" is "Failure", the information of the opposite controller by the lower Ethernet line can be acquired in "Lower Ethernet line monitoring", and the opposite controller is "normal". If determined, the controller in the "standby state" suspends the operation of switching to the "active state" and maintains the "standby state".

By performing such a hold operation, when the connection between the DO / DI terminals between the controllers is disconnected, the system immediately switches to the "active state", and both controllers become the "active state", so-called. Since the split brain state can be suppressed, it becomes possible to provide a facility monitoring system having a highly reliable duplex configuration.

<Failure judgment by failure DO monitoring>
4A and 4B are diagrams for explaining failure determination by "failure DO monitoring" in the embodiment of the present invention. In the "failure DO monitoring", the failure state of the other controller is determined based on whether or not the pulse signal transmitted by the other controller can be detected. The faulty DO output from the DO terminals (36-3, 46-3) in each controller becomes "LO" as shown in (1) of FIG. 4B when the power of the controller is turned off.

On the other hand, as shown in FIG. 4B (2), in a normal state when the power is turned on, a pulse width of software, for example, a pulse width of 50 ms width is constantly output. Since this pulse output is performed by software interrupt, the pulse output sticks to "HI" or "LO" as shown in (3) of FIG. 4B in an abnormal state such as interrupt runaway. If the pulse count cannot be detected at the DI terminals (36-4, 46-4) for a certain period of time and no pulse is detected, the opposite controller is judged to be "failed". The pulse width and the determination time for pulse undetection can be set as appropriate.

<Failure judgment by monitoring lower Ethernet line>
FIG. 4C is a diagram for explaining failure determination by "lower Ethernet line monitoring" in the embodiment of the present invention. In "lower Ethernet line monitoring", the failure state of another controller is determined based on whether or not a message corresponding to the message sent to the other controller has been received.

The main / slave controller sends a predetermined message, for example, a read property message such as "download service" using UDP communication at a predetermined cycle, and reads out data related to the control state of the opposite controller. conduct. When a response message corresponding to the read property message is detected, it is determined to be normal, and when no response is continuously detected for the read property message, it is determined to be a failure. The message to be transmitted, the message transmission cycle, the timeout time, the number of retries, and the number of detections of no response determined to be a failure can be appropriately set.

In this way, by using the two routes of "failure DO monitoring" and "lower Ethernet line monitoring" together for fault judgment of the opposite controller, stable fault judgment that can suppress split brain is realized, thereby realizing stable fault judgment. , It becomes possible to provide a facility monitoring system with a highly reliable duplex configuration.

Further, by using pulse detection for failure determination in "failure DO monitoring", stable failure determination can be realized, and thereby it becomes possible to provide a facility monitoring system having a highly reliable duplex configuration.

<Switching control in the main controller>
FIG. 5A is a diagram for explaining switching control of the “main controller” according to the embodiment of the present invention. Which of the two controllers is to be operated as the "main controller" is preset.

At startup, the main controller starts up in the "standby state", determines the failure state of the slave controller, and reads the active / standby state. As a result, when it is detected that the slave controller is in the "failure" state or the "standby state", the master controller transitions to the "active state" and starts the control operation.

At the time of startup, when the master controller detects that the slave controller is operating in the "normal" state and the "active state", the main controller performs the following processes in order.
(1) When returning, the initial synchronization state is set, the data state of the slave controller operating in the "active state" is synchronized, and the initial synchronization is performed with the control timing of the slave controller.
(2) After the synchronization processing is completed, the state transitions to the active transition waiting state and waits for the slave controller to transition to the "standby state".
(3) After confirming that the slave controller has transitioned to the "standby state", it returns to the "active state" and starts the control operation.

<Switching control in the slave controller>
FIG. 5B is a diagram for explaining switching control of the “subordinate controller” according to the embodiment of the present invention. Which of the two controllers is to be operated as the "subordinate controller" is preset.

At startup, the slave controller starts up in the "standby state" and determines the failure status of the main controller. The slave controller continues in the "standby state" as long as the master controller is operating normally. When the slave controller detects a "failure" of the main controller, it transitions to the "active state".

When the slave controller detects "normal" of the master controller, it enters the initial synchronization state at the time of recovery, and returns to the "standby state" after the synchronization operation with the slave controller of the master controller is completed.

When the slave controller detects a "failure" of the main controller in the initial synchronization state at the time of recovery, the slave controller transitions to the "active state".

The slave controller always detects the failure of the main controller in the "active state". When the recovery from the "failure" of the main controller is detected and the main controller is in the active transition waiting state, the transition to the "standby state" is performed.

<Data synchronization function>
6A and 6B are diagrams for explaining data synchronization in the embodiment of the present invention. In this embodiment, two types of data synchronization, "constant synchronization" and "initial synchronization", are performed.

<Overview of constant synchronization>
FIG. 6A is a diagram for explaining "always-on synchronization" in the embodiment of the present invention. In "constant synchronization", when a service message is transmitted from the monitoring device 10 to the main controller, the predetermined service message is transferred to the slave controller as it is to synchronize the data (push synchronization).

Here, as a countermeasure in the event of network disconnection, if the transfer of the service message fails, periodic write retries are performed so that the data can be synchronized as much as possible.

<Synchronous operation of constant synchronization>
When both the main controller 30 and the slave controller 40 are operating normally and a parameter is set or a command operation is performed by a service message from the monitoring device 10, the controller in the "active state" (here, the main controller). The controller 30) synchronizes the data written from the monitoring device 10 by transferring the service message to the controller in the “standby state” (here, the slave controller 40). The transfer of service messages is performed via the lower Ethernet line (70-1) between the controllers.

The constant synchronization is performed only by the controller in the "active state" (here, the main controller 30). The slave controller 40 transitions to the "active state" only when the main controller 30 fails, and always synchronizes. When the main controller 30 recovers from the failure, the main controller 30 synchronizes by the initial synchronization, then switches to the "active state" and resumes the continuous synchronization, and the slave controller 40 goes to the "standby state". It switches and always stops synchronization.

In the constant synchronization, a predetermined service message determined in advance is to be transferred. For example, a "write property message" such as a "Write Property service request for BACnet communication" can be transferred. By targeting only the messages whose setting parameters are changed, such as the "write property message" from the monitoring device, the efficiency of data synchronization can be improved. The service message to be transferred can be set as appropriate.

If no response to the service transfer is detected, retransmission processing is performed. If the retransmission process also fails, record it in the error log. The transfer timeout time and the number of retries can be set as appropriate.

<Overview of initial synchronization>
FIG. 6B is a diagram for explaining "initial synchronization" in the embodiment of the present invention. When the slave controller 40 detects that the opposing main controller 30 is operating in the "active state" at the time of startup, the slave controller 40 reads a predetermined predetermined data from the opposing main controller 30. "Initial synchronization". As a result, synchronization can be performed with respect to the latest data operating on the main controller 30 (pull synchronization).

<Synchronization operation of initial synchronization>
The slave controller 40 confirms the state of the opposing main controller 30 at startup, and if the main controller 30 is operating normally and in the "active state", scans the data of the opposing main controller 30. , Synchronize the data. The data to be scanned does not have to be all data, and can be limited to predetermined data.

Initial synchronization is performed when the controller is started or restarted. When the main controller 30 recovers from the failure, data scanning is performed from the recovered main controller 30 to the slave controller 40 operating in the "active state". When the main controller 30 recovers from the failure, the slave controller does not transition to the "active state" until the initial synchronization from the main controller 30 is completed.

The initial synchronization is performed via the lower Ethernet line in the same manner as the constant synchronization. The data scan is performed by, for example, a "read property message" such as a "download service" using UDP communication. If the data scan is unsuccessful, it will give up synchronization with the data and be logged in the error log. The timeout time and the number of retries can be set as appropriate.

In this way, in the data synchronization of the duplicate configuration, "always-on synchronization" and "initial synchronization" are used together, and further, in "always-on synchronization", a predetermined predetermined message is targeted for synchronization. It enables efficient data synchronization, which makes it possible to provide a facility monitoring system with a highly reliable duplex configuration.

[Extension of Embodiment]
Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the structure and details of the present invention within the scope of the present invention. In addition, each embodiment can be implemented in any combination within a consistent range.

1 ... Facility monitoring system, 10 ... Monitoring device, 20 ... Engineering tool, 30 ... Main controller, 40 ... Subordinate controller, 50-1 to 50-4 ... I / O module, 60 ... Upper Ethernet line, 70-1 , 70-2 ... Lower Ethernet line.

Claims (4)

A controller in a facility monitoring system equipped with a monitoring device and a redundant controller.
The first I / F for communicating with the monitoring device and
A second I / F for communicating between the duplicated controllers, and
A DO / DI terminal for transmitting and receiving signals between the duplicated controllers, and
A failure determination unit and a failure determination unit that determine the failure state of the other duplicated controller based on the transmission / reception of a message using the second I / F and the transmission / reception of a signal using the DO / DI terminal. It is equipped with a switching processing unit that switches between the standby state and the active state based on the judgment result.
When the failure determination unit determines that the controller in the active state has a failure based on the message using the second I / F in the standby state,
The switching processing unit switches to the active state and performs switching to the active state.
In the standby state, the failure determination unit determines that the controller in the active state has a failure based on the signal using the DO / DI terminal, and based on the message using the second I / F. , If the active controller is determined to be normal,
The switching processing unit is a controller that does not switch to the active state. The failure determination unit
The controller according to claim 1, wherein the determination of the failure state using the DO / DI terminal is determined based on whether or not the pulse signal transmitted by the other duplicated controller can be detected. The failure determination unit
The controller according to claim 1 or 2, wherein the determination of the failure state using the second I / F is determined based on whether or not a message corresponding to the message transmitted to the other duplicated controller has been received. A facility monitoring system including the controller according to any one of claims 1 to 3.

Images