JP4099816B2 - Redundant controller - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to redundancy of a controller that executes control in a process control system, and particularly relates to redundancy of a controller in which control software that functions as an execution engine is realized by software PLC (Programmable Logic Controller). is there.
[0002]
[Prior art]
The applicant has proposed a redundant controller that achieves a similar object in process control in Japanese Patent Laid-Open No. 7-36720 “Duplexed Computer Device”. The configuration and operation will be described with reference to FIG.
[0003]
Reference numerals 1 and 2 denote redundant controllers in which two controllers (a control-side controller and a standby-side controller) that can be executed alone are connected by a system bus 10. In each controller, 11 is an OS execution memory unit that stores an operating system (OS), and 12 is a program execution memory unit that stores an application program that operates while using a function of the OS (system call).
[0004]
Reference numeral 13 denotes a CPU device that operates according to a program stored in each memory. Reference numeral 14 denotes an I / O device that performs input / output with a process to be controlled. Which of the I / O devices is actually involved in control? Depending on whether to access, 1 and 2 are divided into a controller on the control side and a controller on the standby side. Reference numeral 15 denotes an inter-process-device interrupt generating means for transmitting an interrupt received by its own CPU device to the CPU device in the counterpart controller.
[0005]
Reference numeral 16 denotes step counting means, which is started by starting a program executed by the CPU device, counts the number of execution steps of the program, and stores the number of steps executed so far by interruption to the CPU device.
[0006]
17 is a synchronization deviation adjusting means, which compares the number of execution steps stored in its own step counting means with the number of execution steps stored in the step counting means in the partner controller when the program interrupted by the interruption is restarted, When the difference is larger than a predetermined value, control is performed so that the CPU device on the controller side with a small number of execution steps starts to operate first by the number of steps of the difference, and the CPU devices of both controllers operate synchronously. To do.
[0007]
In this way, in a redundant controller composed of two controllers, which are divided into a control side and a standby side, depending on which I / O device actually involved in the control accesses, each controller has application software. A feature is that a means for counting the number of execution steps and a synchronization deviation adjusting means are provided so as to automatically synchronize by capturing an opportunity for interrupt processing.
[0008]
Therefore, the control-side controller and the standby-side controller always execute the same processing synchronously, and the control operation to the standby-side controller in the case where the control-side goes down without building a large-scale system. Switching can be performed immediately while maintaining continuity.
[0009]
Further, even when the two controllers perform an operation for synchronization based on a system call, and the system call is not performed for a long time, a shift in the synchronization operation can be essentially avoided. Therefore, the application program does not need to be aware of the redundancy processing (processing for synchronization) at the time of design, and the application program can be easily created.
[0010]
[Problems to be solved by the invention]
Such redundant controllers use highly customized dedicated hardware and OS to realize redundancy, and application software running on the platform does not need to be aware of redundancy. It can be said that it is a perfect redundancy system.
[0011]
However, the recent technological innovation of computer systems is extremely fast, and it is necessary to develop everything in-house to apply the conventional redundancy method to the evolution of hardware and OS, which requires enormous cost and time. Become.
[0012]
In recent years, the execution engine of a system is often constructed by a software PLC (Programmable Logic Controller) whose function is defined by software. Furthermore, the software PLC, which is written in a programming language conforming to the IEC6113-3 standard, tends to promote system openness and standardization.
In this case, the OS of the PC and the OS for the software PLC use a commercially available general-purpose system to construct a multi-vendor environment that operates on the general-purpose PC.
[0013]
On the other hand, the conventional technology requires dedicated hardware as described above, and cannot be applied to a general-purpose computer system such as a PC. In other words, there is no portability.
Furthermore, it is necessary to put a highly redundant control mechanism in the OS and device driver, and it is practically difficult to incorporate these functions into a commercially available OS.
[0014]
An object of the present invention is to provide a redundant controller that can be realized by using general-purpose hardware and an OS without requiring a special OS including a special hardware and a redundant control mechanism.
[0015]
[Means for Solving the Problems]
In order to achieve such a problem, a feature of the invention described in claim 1 of the present invention is a redundant controller including a control side controller and a standby side controller.
A control task having the same configuration that is provided in each of the control-side controller and the standby-side controller and that operates with a predetermined scan cycle using control software that uses a general-purpose OS as an execution engine;
An I / O buffer provided in each of the control-side controller and the standby-side controller, which holds data input to each of these control tasks and data obtained by executing a control operation;
An I / O driver that operates on the controller side and communicates with an I / O device that performs input and output with the process;
An I / O handler called by the control side controller and standby side controller when the control task requests input / output to the I / O device;
An equalization library that relays communication between the I / O handler called by the control-side controller and the I / O handler called by the standby-side controller;
With
For each scan period, the I / O handler of the control-side controller is
When reading data, the input data from the I / O driver is written to the I / O buffer of the control-side controller, and waits with the I / O handler of the standby-side controller via the equalization library. Synchronize, copy the input data to the I / O buffer of the standby controller,
When writing data, the output data of the I / O buffer of the control-side controller is synchronized with the I / O handler of the standby-side controller via the equalization library, and is synchronized with the I / O handler of the control-side controller. Write to the / O driver .
[0016]
The control side controller and the standby side controller include a socket task that communicates with an external device, and the socket task of the control side controller receives a request from the external device and receives the request from the external device. The request processing from the external device is notified to the socket task of the standby controller via the equalization library .
[0017]
According to a third aspect of the present invention, the control software is realized by a software PLC .
[0018]
According to a fourth aspect of the present invention, the software PLC is described in a programming language conforming to the IEC61131-3 standard .
[0020]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a functional block diagram for explaining the concept of a redundant controller to which the present invention is applied.
The redundant controller according to the present invention has a hardware configuration in which a component (CPU card, I / O card, etc.) operating alone is configured as a pair configuration of the control-side controller 1 and the standby-side controller 2, and both are connected to the system bus (FIG. (Not shown). The software executes the same program (OS and application) on each controller and executes them in parallel by synchronizing them with each other.
[0021]
Each redundant controller is divided into one that performs actual control (control side) and one that does not participate in actual control and is waiting (standby side). The same processing is performed. The control side / standby side is distinguished by whether or not the I / O is actually performed.
I / O is output only by the control side. The input is read by the control side, and the input data is transferred to the standby side. When the control side goes down, the control right immediately shifts to the standby side.
[0022]
In each of the controllers 1 and 2, reference numeral 3 denotes control software that functions as an execution engine, and performs input / output of one or a plurality of user-defined tasks (task A and task B) by the software PLC and data for these tasks. Has an I / O buffer.
[0023]
Reference numeral 31 denotes a control task by the software PLC using the control software as an execution engine, which can be freely constructed by a user in a program language compliant with the IEC61131-3 standard. Reference numeral 4 denotes various application software executed asynchronously with the control software 3. The application software 4 is software that performs document creation, spreadsheet calculation, and the like, for example. Reference numeral 5 denotes an I / O driver, and only the control-side controller 1 communicates with an I / O device 6 that performs input / output with a process.
[0024]
On the control software, a user-defined control task operates at a fixed cycle every scan cycle, accesses the I / O buffer, and inputs / outputs data. The control task basically inputs data via the I / O buffer at the beginning of the scan, executes each control program (operation processing such as function block and sequential function block), and finally to the I / O buffer. Is output.
[0025]
Input / output to / from the I / O device 6 is performed by calling the I / O driver 5 of the control-side controller. At this time, by performing synchronization (waiting) between control and standby and equalization processing of I / O data, the control task between control and standby executes the same processing synchronously.
[0026]
The synchronization operation of the control task will be described with reference to FIG. In the present invention, synchronous execution of control tasks is realized by waiting for I / O input / output between the control side and the standby side.
The control task 31 inputs I / O at the head of the scan. In the I / O input process, the control side and the standby side are synchronized (waiting), and the I / O data read by the control side is copied (equalized) to the standby side.
[0027]
Each control program described in a program language compliant with the IEC61131-3 standard is executed. At this time, output of I / O is performed, but output is performed to the I / O buffer 5, and output to the actual I / O device 6 is not performed. For this reason, it is not necessary to synchronize the output between the control side and the standby side.
[0028]
The control task 31 in the control-side controller finally outputs the data in the I / O buffer 5 to the actual I / O device 6.
In the output processing of I / O, it is possible to configure so that I / O is immediately output (the writing to the actual I / O device 6 is performed simultaneously with the output to the I / O buffer means).
Also in this case, since the control side and the standby side are synchronized in the I / O output process, the continuity of the process between the control and the standby is guaranteed.
[0029]
In other words, even if the task operation timing differs between control and standby, synchronization is performed at the I / O input / output timing, and if an abnormality occurs on the control side by executing synchronously, the control is immediately transferred to the standby side. Therefore, the control task process can be continued without interruption.
[0030]
However, although the same tasks are synchronized, task scheduling (operation order) may differ between control and standby. For example, the task is activated in the order of task A and task B on the control side, but may be activated in the order of task B and task A in the standby state.
[0031]
A general application 4 not related to the control software 3 is executed asynchronously between the control side and the standby side. In other words, there is a possibility that the processing being executed is different between the same application on the control side and the standby side, and the continuity of the processing is not guaranteed when the control right is switched.
[0032]
A specific configuration example of the control software 1 and its peripheral related functions will be described with reference to FIG.
[0033]
The bus driver 27 is a driver that controls a system bus that is a backplane bus of the controller. Various I / O devices are connected to the system bus, and the I / O driver 28 accesses the I / O card.
Further, the bus driver 27 is used as a communication bus with the equalization library 29 for performing synchronization between the control side and the standby side and equalization of data including I / O. A general-purpose bus can be used as the communication bus used for the equalization communication.
[0034]
28 is an I / O driver for the system bus, and 210 is an I / O driver that controls various I / O cards. These I / O drivers operate only on the control-side controller, and the standby side does not perform any processing. Since synchronization and equalization with the counterpart controller CPU is performed by the I / O handler, basically no redundancy is considered.
[0035]
Reference numeral 232 denotes an I / O handler in the control software, which is called when the control task performs I / O input / output, and executes data read / write. At the time of reading data, the data read from the I / O drivers 28 and 210 is written to the I / O buffer means, synchronized with the standby side I / O handler through the equalization library 29, and the input data is copied. At the time of writing, it synchronizes with the standby side I / O handler through the equalization library 29 and writes the output data of the I / O buffer means to the I / O driver means.
[0036]
Reference numeral 234 denotes a TCP / IP socket task, which communicates with a station (not shown) such as a control software configurator, a human-machine interface, and other controllers via the control bus driver 211. This socket task is a communication interface using Ethernet (registered trademark) and TCP / IP as communication media.
In the control software, communication via the control bus driver 211 is defined by a protocol called communication interface communication, and is configured to be adaptable to various communication media (RS232C and vendor-specific buses).
[0037]
When this socket task receives a client request from the configurator or the like, it requests the server task 235 to process the request, and notifies the TCP / IP socket task (not shown) on the standby side through the equalization library 29 of the request. Thus, equalization of the internal state between the control side and the standby side is performed for external access to the controller.
[0038]
A control right monitoring task 212 monitors the state of the control side / standby side and executes control right switching. By realizing the function of this task (detection and notification of controller abnormality) with hardware, it is possible to reduce the switching time (within 1 second).
[0039]
【The invention's effect】
As is clear from the above description, according to the present invention, a redundant controller can be easily realized by using general-purpose hardware and an OS without requiring a special hardware and a special OS including a redundancy control mechanism. Can be realized. Furthermore, since the present invention is less dependent on the OS, porting to a commercial OS is easy.
[0040]
In particular, when the execution engine of a redundant system is realized by a software PLC and this software PLC is applied to a program language written in compliance with the IEC6113-3 standard, the system is opened and the standardization environment is Can contribute to construction.
[Brief description of the drawings]
FIG. 1 is a functional block diagram illustrating the concept of a redundant controller to which the present invention is applied.
FIG. 2 is a time chart for explaining the synchronous operation of control tasks on the control side and standby side in the present invention.
FIG. 3 is a functional block diagram illustrating a specific configuration example of control software according to the present invention.
FIG. 4 is a system configuration diagram illustrating an example of a conventional redundant controller.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Control side controller 2 Standby side controller 3 Control software 31 Control task 32 I / O buffer 4 Application 5 I / O driver 6 I / O device

Claims (4)

In a redundant controller consisting of a controller on the control side and a controller on the standby side,
A control task having the same configuration, which is provided in each of the control-side controller and the standby-side controller and operates at a predetermined scan cycle using control software using a general-purpose OS as an execution engine;
An I / O buffer provided in each of the control-side controller and the standby-side controller that holds data input to each of these control tasks and data obtained by executing a control operation;
An I / O driver that operates on the controller side of the controller and communicates with an I / O device that performs input / output with a process;
An I / O handler called by the control-side controller and standby-side controller when the control task requests input / output to the I / O device;
An equalization library that relays communication between the I / O handler called by the control-side controller and the I / O handler called by the standby-side controller;
With
For each scan period, the I / O handler of the control-side controller is
When data is read, the input data from the I / O driver is written to the I / O buffer of the control-side controller, and also waits with the I / O handler of the standby-side controller via the equalization library. Synchronize, copy the input data to the I / O buffer of the standby controller,
When writing data, the output data of the I / O buffer of the control-side controller is synchronized with the I / O handler of the standby-side controller via the equalization library, and the I / O handler of the control-side controller is synchronized. Write to the / O driver,
A redundant controller characterized by that. The control-side controller and the standby-side controller include a socket task that communicates with an external device, and the control-side controller socket task receives a request from the external device and commands its own request processing, and 2. The redundant controller according to claim 1, wherein a request from the external device is notified to a socket task of the standby controller via an equalization library. The redundant controller according to claim 1, wherein the control software is realized by a software PLC. The soft PLC IEC61131-3 4. The redundant controller according to claim 3, wherein the redundant controller is written in a programming language conforming to a standard.

Images