JP2023076489A - Reception panel - Google Patents

Abstract

To obtain a reception panel with an appropriate redundant configuration capable of avoiding system down when failure occurrence.SOLUTION: A reception panel comprises a duplexed first and second controllers and a redundant unit capable of selectively switching one of the controllers. The second controller comprises a main control execution unit executing monitoring and control of terminal devices, and a monitoring unit monitoring whether an abnormality occurs in the first controller during normal operation, and the monitoring unit determines that when the first control unit is in normal operation, abnormality occurs in the first controller when confirming no existence of a control node fixedly assigned to the controller executing monitoring and control in the normal operation, and switches and controls the redundant unit, and causes the second controller to maintain monitoring and control of the plurality of terminal devices in the normal operation.SELECTED DRAWING: Figure 3

Description

TECHNICAL FIELD The present invention relates to a receiving panel that monitors and controls terminal equipment and exchanges information on monitoring and control with a host device, and more particularly to a disaster prevention receiving panel used in a disaster prevention system.

Emergency facilities are installed in tunnels such as motorways to protect people and vehicles from fire accidents that occur in tunnels. Such emergency facilities include fire detectors, manual alarm devices, and emergency telephones for fire monitoring and notification. In addition, a fire hydrant system will be installed to extinguish the fire and prevent the spread of fire, and a water spray system will be installed to protect the tunnel frame and ducts from fire. .

As described above, there is a conventional technology for constructing a tunnel disaster prevention system by providing a disaster prevention receiving panel that monitors and controls various terminal devices installed in a tunnel (see, for example, Patent Document 1).

JP-A-2002-246962

However, the prior art has the following problems.
The main control function of the tunnel disaster prevention receiver board applied to the tunnel disaster prevention system is handled by a personal computer, and it is operated by a single personal computer. As the personal computer, an industrial one capable of continuous operation is used.

However, personal computers are subject to various failures, such as hardware failures such as hard disk failures and motherboard failures, and software failures such as OS freezes and application errors. In the following description, the state in which such a hardware failure or software failure has occurred in the personal computer may be referred to as "at the time of occurrence of an abnormality". When such an anomaly occurs, the PC responsible for the main control function goes down, the function of the tunnel disaster prevention receiver panel stops, and the operation of the tunnel disaster prevention system is hindered.

When such an abnormality occurs, the main control unit is quickly repaired or replaced to cope with the problem.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a receiving panel having an appropriate redundant configuration capable of avoiding a system down when an abnormality occurs.

The receiving board according to the present invention includes a first control device and a second control device that are duplicated to monitor and control the terminal device, or any of the first control device and the second control device. A receiving board equipped with a redundant unit that allows the selected control device to monitor and control the terminal device during normal operation by selectively switching between the two, and makes the non-selected control device stand by as a backup. The second control device includes a main control execution unit that monitors and controls the terminal device, and the first control device monitors and controls the terminal device during normal operation. a monitoring unit for monitoring whether or not an abnormality has occurred in the first control device when standing by for backup, and the first control device performs monitoring and control during normal operation; During normal operation, the monitoring unit detects the presence of a control node that is fixedly assigned to the control device that is performing monitoring and control during normal operation, and checks that the control device that is performing monitoring and control during normal operation has a redundant unit. If the presence of the control node cannot be confirmed by constantly monitoring via a communicable route, it is determined that an abnormality has occurred in the first control device, and the first control device to the first The redundant unit is switched and controlled so as to select and switch to the second control device, and the second control device continues monitoring and control of the terminal device during normal operation.

According to the present invention, it is possible to determine, based on at least one of the three types of monitoring functions, that an abnormality has occurred in the main control unit personal computer operating as normal operation, and even when an abnormality occurs, the backup main computer can be used. It is equipped with a configuration that enables continuous operation of the system by switching to the control unit personal computer. As a result, it is possible to obtain a receiving panel having an appropriate redundant configuration capable of avoiding system down when an abnormality occurs.

FIG. 10 is an explanatory diagram showing a schematic configuration of a conventional tunnel disaster prevention system in which a main control personal computer is not redundant; BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is an explanatory diagram showing a schematic configuration of a tunnel disaster prevention system in which main control personal computers are made redundant according to Embodiment 1 of the present invention; 1 is an explanatory diagram showing a detailed configuration of a tunnel disaster prevention system in which a main control personal computer is made redundant according to Embodiment 1 of the present invention; FIG.

Hereinafter, the receiving board of the present invention will be described with reference to the drawings.
According to the present invention, when the main control personal computer is duplicated, each main control personal computer monitors the state of the other main control personal computer by at least one of three methods. The technical feature of this system is to prevent the system from going down and to enable continuous monitoring and control in response to the occurrence of various abnormalities. Therefore, a receiving panel having such technical features will be described in detail below using an embodiment, taking as a specific example a disaster receiving panel for monitoring fires in tunnels, etc. in particular.

Embodiment 1.
Before describing the specific configuration of the present invention, a schematic configuration of a conventional disaster prevention receiving panel and a schematic configuration of a disaster prevention receiving panel according to the present invention will be described with reference to the drawings. In the following description, the configuration that is incorporated in the disaster prevention receiving panel and executes monitoring and control of the system will be referred to as a "main control unit personal computer".

FIG. 1 is an explanatory diagram showing a schematic configuration of a conventional tunnel disaster prevention system in which the main control personal computer is not made redundant. In general, one disaster prevention receiver board 110 is provided in each tunnel, and the inside of the tunnel is monitored by a plurality of connected terminal devices 30 . The remote monitoring control device 20 checks the status of a plurality of tunnels and is connected to a plurality of disaster prevention receiving boards 110 . In the example of the conventional tunnel disaster prevention system shown in FIG. 1, a disaster prevention receiving panel 110 having one main control personal computer 111 is provided between the remote monitoring control device 20 and each terminal device 30 in the tunnel. be described as existing.

In such a configuration, if some kind of hardware failure or software failure occurs in the main control unit personal computer 11, each terminal device 30 in the tunnel cannot be monitored and controlled, and the system goes down, rendering the tunnel empty. It becomes a monitoring state.

On the other hand, FIG. 2 is an explanatory diagram showing a schematic configuration of the tunnel disaster prevention system in which the main control personal computer is made redundant according to the first embodiment of the present invention. The tunnel disaster prevention system according to the first embodiment shown in FIG. 2 includes a disaster prevention reception board 10 instead of the disaster prevention reception board 110 in the conventional tunnel disaster prevention system shown in FIG. That is, the tunnel disaster prevention system according to the first embodiment shown in FIG. A disaster prevention receiving panel 10 having internal personal computers 11a and 11b is provided.

In the tunnel disaster prevention system with the configuration shown in FIG. 2, even if the main control personal computer 11a goes down due to some kind of failure, the system can continue to operate by switching to the backup main control personal computer 11b. .

In order to realize such switching, in the receiving panel according to the first embodiment, the main control unit personal computer on the backup side monitors by software whether the main control unit personal computer in normal operation is functioning normally. The technical feature is that it has a function to Therefore, the specific internal configuration and software processing of the main control personal computers 11a and 11b will be described in detail with reference to FIG.

FIG. 3 is an explanatory diagram showing the detailed configuration of the tunnel disaster prevention system in which the main control personal computer is made redundant according to Embodiment 1 of the present invention. The tunnel disaster prevention system according to the first embodiment shown in FIG. .

The remote monitoring control device 20 and the two main control personal computers 11a and 11b can communicate with each other via the switching HUB 51. FIG. Also, the redundant unit 40 is controlled by the monitoring process 4 in the main control personal computer 11 so as to be selectively connected by hardware to one of the two main control personal computers 11a and 11b. . The details of the internal configuration of the main control personal computer 11 will be described later.

The main control personal computer 11a or main control personal computer 11b connected to the redundant unit 40 and the intra-panel module 53(n) that communicates with each terminal device 30 in the tunnel are used for communication within the receiving panel 10. mutual communication is possible via the HUB 52 provided with the communication protocol of . As a result, the main control personal computers 11a and 11b execute monitoring and control of each in-tunnel terminal device 30 via the redundant unit 40, HUB 52, and in-board module 53(n). Arcnet, Ethernet (registered trademark), or the like can be applied as a communication protocol for performing communication within the receiving panel 10, and the communication protocol is not particularly limited in the present invention.
Note that FIG. 3 illustrates a case in which six in-board modules 53(1) to 53(6) corresponding to node IDs 1 to 6 are provided as in-board modules 53(n). there is

Next, the configuration and functions of the main control personal computers 11a and 11b that execute the redundancy function will be described in detail. The main control personal computer 11a includes main control software 1a, a LAN 2a, a communication section 3a, a monitoring process 4a, a communication section 5a, a communication section 6a, and a contact input/output section 7a. Similarly, the main control personal computer 11b includes main control software 1b, LAN 2b, communication section 3b, monitoring process 4b, communication section 5b, communication section 6b, and contact input/output section 7b.

In this way, the main control personal computers 11a and 11b have similar configurations so that the other can function as a backup while one of them is operating during normal operation. Therefore, hereinafter, the first main control unit personal computer 11a is a control device (corresponding to a first control device) operating during normal operation, and the second main control unit personal computer 11b (second (corresponding to the control device of ) is a control device on standby for backup.

In FIG. 3, since the first main control unit personal computer 11a is the first control device that operates during normal operation, the main control unit software 1a (corresponding to the first main control execution unit) is written as "main control unit software main", and the monitoring process 4a is written as "monitoring process main". Similarly, in FIG. 3, the second main control unit personal computer 11b is the second control device that is on standby for backup, so the main control unit software 1b (corresponding to the second main control execution unit) is described as "main control unit software secondary", and the monitoring process 4b is described as "monitoring process secondary".

The main control unit software 1a is a main control execution unit that executes software for monitoring and controlling the in-tunnel terminal device 30 during normal operation. Specifically, the main control unit software 1a mutually communicates information related to monitoring and control with the remote monitoring control device 20 via the LAN 2a. Further, the main control unit software 1a mutually communicates information related to monitoring and control with each in-tunnel terminal device 30 via the communication unit 3a.

Therefore, the main control unit software 1a, the LAN 2a, and the communication unit 3a are also provided in the conventional main control unit personal computer 11 that does not have a redundancy function, and are standard equipment for executing monitoring and control. corresponds to

On the other hand, the monitoring process 4a, the communication section 5a, the communication section 6a, and the contact input/output section 7a correspond to the configuration newly installed in the main control personal computer 11a in order to realize the redundancy function. Similarly, the monitoring process 4b, the communication section 5b, the communication section 6b, and the contact input/output section 7b correspond to the configuration newly installed in the main control personal computer 11b in order to realize the redundancy function.

While cooperating with the monitoring process 4b, the monitoring process 4a checks via the monitoring process 4b whether its own main control unit software 1a and the partner main control unit software 1b and monitoring process 4b are operating normally. It is a monitoring unit that executes software that monitors whether Similarly, the monitoring process 4b cooperates with the monitoring process 4a to ensure that its own main control unit software 1b and the counterpart main control unit software 1a and monitoring process 4a operate normally via the monitoring process 4a. It is a monitoring unit that executes software that monitors whether or not the

The communication unit 5a and the communication unit 5b are communication interfaces for mutual communication between the monitoring process 4a and the monitoring process 4b.

The communication unit 6b is a communication interface that enables the monitoring process 4b to monitor the presence of a specific node via the HUB 52 when the main control personal computer 11b is operating as a backup.

Also, the communication unit 6a allows the monitoring process 4a to monitor the presence of a specific node (node 255 of the communication units 3a and 3b to be described later) via the HUB 52 when the main control personal computer 11a operates as a backup. It is a communication interface for enabling

The details of the monitoring function of the main control unit software 1a, 1b (communication units 3a, 3b) using the monitoring processes 4a, 4b (communication units 6a, 6b) will be described later.

The contact input/output section 7a and the contact input/output section 7b are input/output sections for the monitoring process 4a and the monitoring process 4b to mutually confirm the contact input/output of the main control personal computers 11a and 11b.

In the first embodiment, the monitoring process 4a included in the main controller personal computer 11a is included in the main controller personal computer 11b via the communication unit 5a, the communication unit 6a, and the contact input/output unit 7a. When the main control personal computer 11a goes down due to a failure, the monitoring process 4b is switched to the main control personal computer 11b for backup via the communication unit 5b, the communication unit 6b, and the contact input/output unit 7b. It has three monitoring functions. Therefore, these three monitoring functions are described in detail below.

[First Monitoring Function] Monitoring Function Using Communication Units 5a and 5b By performing mutual communication between the main monitoring process 4a and the sub-monitoring process 4b using the communication units 5a and 5b, the monitoring processes 4a and 4b communicate with each other. Perform survival check (stop software, check for anomalies). When the communication with the other party is interrupted, it is possible to consider that the other party's personal computer has failed and switch to a standby personal computer for backup.

In the configuration example shown in FIG. 3, the monitoring process 4b on standby as a backup communicates with the monitoring process 4a in the main control personal computer 11a operating in normal operation via the communication units 5b and 5a. , the survival of the main control unit personal computer 11a is confirmed (more specifically, abnormality confirmation such as stopping of the software of the monitoring process 4a) is performed. When communication with the monitoring process 4a is interrupted, the monitoring process 4b determines that the main control personal computer 11a has failed (more specifically, the monitoring process 4a has failed).

When the monitoring process 4b determines that the main control personal computer 11a has failed, the monitoring process 4b switches the redundant unit 40 so that the main control personal computer 11b, which stands by for backup, executes monitoring and control. to run. As a result, even if the main control personal computer 11a fails and mutual communication via the communication units 5a and 5b becomes impossible, the system can continue to operate by the main control personal computer 11b for backup. .

[Second monitoring function] Monitoring function using communication units 6a and 6b In communication with on-board module 53(n), main control unit software 1 (that is, main control unit software 1a or A specific control node (for example, node ID 255) is fixedly assigned to both the main control unit software 1b). The redundancy unit 40 ensures that only one of the main control unit software 1a and the main control unit software 1b exists in the communication path with the on-board module 53(n) via the redundancy unit 40. ing. What exists is the main control unit software 1 in operation.

Therefore, the monitoring process 4b standing by as a backup constantly monitors the presence of the node ID 255 of the main control unit software 1a via the HUB 52 via the communication unit 6b. When the existence of the node ID 255 cannot be confirmed, the monitoring process 4b determines that an abnormality such as a stoppage of the main control unit software 1a or an abnormality has occurred in the main control unit personal computer 11a.

When the monitoring process 4b determines that an abnormality has occurred in the main control unit software 1a or in the main control unit personal computer 11a, it performs monitoring and control using its own main control unit personal computer 11b that stands by as a backup. To do so, the switching of the redundant unit 40 is performed. As a result, even if the presence of the node ID 255 of the main control unit software 1a cannot be confirmed due to an abnormality in the main control unit software 1a or an abnormality in the main control unit personal computer 11a, the main control unit personal computer 11b for backup can perform system continuous operation is possible.

[Third monitoring function] A monitoring function using the contact input/output units 7a and 7b. It is connected to the contact input of the contact input/output section 7b in the personal computer 11b. Similarly, the contact output from the contact input/output section 7b in the main control personal computer 11b is connected via the redundant unit 40 to the contact input of the contact input/output section 7a in the main control personal computer 11a. there is

Using such connections, the monitoring processes 4a and 4b mutually confirm existence based on contact input/output. Specifically, the monitoring processes 4a and 4b turn on the contact output when their personal computers are activated. As a result, the monitoring processes 4a and 4b confirm whether or not the contact output from the other party is in the ON state as the contact input, and if the contact input is OFF, it can be determined that the other party's personal computer has failed. .

In the configuration example shown in FIG. 3, the monitoring process 4b on standby as a backup receives contact input from the monitoring process 4a via the contact input/output unit 7b, the redundancy unit 40, and the contact input/output unit 7a. is in the ON state. When the contact input from the monitoring process 4a is turned off, the monitoring process 4b determines that the main control personal computer 11a has failed.

When the monitoring process 4b determines that the main control personal computer 11a has failed, the monitoring process 4b switches the redundant unit 40 so that the main control personal computer 11b, which stands by for backup, executes monitoring and control. to run. As a result, even if the main control personal computer 11a fails and the contact input/output cannot be read normally, the system can continue to operate by the main control personal computer 11b for backup.

As described above, according to Embodiment 1, a configuration is provided in which it is possible to determine, based on the three types of monitoring functions of the monitoring process 4, that a failure has occurred in the main control unit personal computer operating as normal operation. there is Therefore, when a failure is detected in at least one of the three types of monitoring functions, the main control unit personal computer 11 standing by as a backup is switched to the main control unit personal computer 11 for backup, so that the system can continuous operation is possible. Then, it transmits to the remote monitoring control device 20 that the main control unit personal computer 11 which has been normally operated has failed.

In the present embodiment, a system in which the disaster prevention receiver 10 is connected to the tunnel terminal device 30 has been described. It will be connected to the terminal device 30 . In this case, the redundant configuration of the relay board is the same as that of the disaster prevention receiving board 10, and the disaster prevention receiving board 10 and the relay board are redundant.

Conventionally, only hard disks have been duplicated by a mirror configuration. On the other hand, the present invention further includes a configuration for executing the three types of monitoring functions described above. As a result, with respect to the main control unit personal computer operating as normal operation, the first monitoring function realizes the abnormality detection in which the monitoring software has stopped, and the abnormality detection in which only the main control unit software has stopped is realized. This is realized by the second monitoring function, and failure detection of the hardware itself is realized by the third monitoring function. A hardware failure can also be detected by the first monitoring function and the second monitoring function. Therefore, it is possible to realize a receiving panel with an appropriate redundant configuration that can avoid system down when a failure occurs, against various assumed failures.

Also, the first to third monitoring functions do not detect an abnormality individually, but some abnormalities are detected in combination. For example, when the line between the communication units 5a and 5b is disconnected, the first monitoring function detects that both the monitoring processes 4a and 4b are abnormal. Therefore, by monitoring disconnection between the communication units 5a and 5b with a combination of the first monitoring function and the second monitoring function, even if the communication between the communication units 5a and 5b is interrupted, the monitoring process 4b can detect node ID 255. is confirmed, the main control personal computer 11a can monitor the system, and the main control personal computer 11b does not switch to itself, and warns of disconnection abnormality.

In addition, when an abnormality occurs in which only the main control unit software detected by the first or second monitoring function stops, the main control unit in which the abnormality occurred during normal operation from the main control unit PC 11 for backup A restart signal may be output to the internal personal computer 11 to resolve the software abnormality.

1a, 1b main control unit software, 2a, 2b LAN, 3a, 3b communication unit, 4a, 4b monitoring process, 5a, 5b communication unit, 6a, 6b communication unit, 7a, 7b contact input/output unit, 10 disaster prevention receiver , 11a, 11b main control personal computer, 20 remote monitoring control device, 30 terminal device in tunnel, 40 redundant unit, 51 switching HUB, 52 HUB, 53 in-board module.

The receiving panel according to the present invention includes a first control device and a second control device duplicated for executing monitoring and control of the terminal device, or any of the first control device and the second control device. A redundancy unit that allows the selected control device to perform monitoring and control of the terminal device during normal operation via the HUB , and makes the non-selected control device stand by as a backup. , wherein the second control device includes a main control execution unit that monitors and controls the terminal device, and the first control device monitors and controls the terminal device during normal operation. and a monitoring unit for monitoring whether or not an abnormality has occurred in the first control device when it is on standby for backup, and the first control device is the redundant unit and the HUB. During normal operation, the monitoring and control of the terminal device is executed by the communication path that passes through in order , and when the second control device is functioning as a backup , the monitoring unit of the second control device Confirm the existence of the control node fixedly assigned in the first control device that is executing monitoring and control by constantly monitoring the communication path that goes through the HUB and the redundant unit in that order , and confirm the existence of the control node. If it is not possible, it is determined that an abnormality has occurred in the first control device, and the redundant unit is switched and controlled to selectively switch from the first control device to the second control device, and the second control device It allows continuous monitoring and control of the terminal equipment during normal operation.

Claims (1)

a first control device and a second control device duplicated to monitor and control the terminal device;
By selectively switching between the first control device and the second control device, the selected control device executes monitoring and control of the terminal device during normal operation, and the non-selected control device a redundant unit for standby for backup, and
The second control device is
a main control execution unit that executes monitoring and control of the terminal device;
When the first control device is executing the monitoring and control of the terminal device during the normal operation and is on standby for the backup, an abnormality has occurred in the first control device. and a monitoring unit that monitors whether there is
When the first control device is executing the monitoring and control during the normal operation, the monitoring unit selects a control node fixedly assigned to the control device executing the monitoring and control during the normal operation. The existence of the control node is confirmed by constant monitoring via a communication path through the redundant unit by the control device executing the monitoring and control during the normal operation, and the existence of the control node cannot be confirmed. in such a case, it is determined that an abnormality has occurred in the first control device, the redundant unit is controlled to switch from the first control device to the second control device, and the second control device is selected. A receiving panel for continuing monitoring and control of the terminal device during the normal operation by the control device of the above.

Images