JP4465824B2 - Controller system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an information processing apparatus in which CPUs have redundancy by a one-to-one pair configuration, and more particularly to control of CPU operation / standby switching.
[0002]
[Prior art]
FIG. 6 shows a general configuration of a controller system such as a programmable controller.
[0003]
Such a controller system includes one or more CPU modules constituted by a CPU, a memory, etc., an I / O (input / output) module that is connected to a control device and exchanges measurement values and control commands with the device, A communication module or the like shown in the figure is mounted on the base board 100. The CPU takes in input data and performs calculation, and transmits the result to the I / O module to connect the device connected to the I / O module. Take control. In the case of the figure, eight CPU modules CPU modules CPU0 to CPU7 and four I / O modules I / O modules I / O0 to I / O3 are provided on three baseboards 100-1 to 100-3. Has been implemented.
[0004]
The base board 100 supplies power to each mounted module, and each module mounted on the same base board 100 is connected by a parallel bus 101. All modules constituting the system are serially connected by a serial bus 102. In the controller system, the serial bus 102 enables I / O data transfer function and message communication function between modules, and each parallel bus 101 enables high-speed data transfer by a physical access function.
[0005]
By the way, in such a controller system, in order to improve reliability, there is a case where two CPU modules are combined into one set to make the system redundant.
For example, in the configuration of FIG. 6, CPU8 and CPU1, CPU2 and CPU3, CPU4 and CPU5, and CPU6 and CPU7 among the eight CPU modules are paired to perform duplication. Further, the system in this case has a duplex configuration, and CPU0, CPU2, CPU4, and CPU6 are in an operating state and CPU1, CPU3, CPU5, and CPU7 are in a standby state as an initial state.
[0006]
In the configuration of FIG. 6, when the system is in operation, data is exchanged between the active CPUs mainly using the parallel bus 101. A set of CPU modules that can exchange data using the parallel bus 101. Matching is limited. In the case of FIG. 6, the CPU 0 can communicate with the other CPU modules CPU1 to CPU3 on the baseboard 100-1 via the parallel bus 101-1, but the CPU4 to CPU7 on the baseboard 100-2 have a parallel bus. Communication by 101 cannot be performed.
[0007]
In order to deal with this point, there is a configuration in which all CPU modules are mounted on one base board 100-4 and the CPU modules are connected by one parallel bus 101-4 as in the configuration of FIG. In this case, data can be transferred between all the CPU modules by the parallel bus 101-4.
[0008]
Alternatively, a configuration as shown in FIG. The configuration of FIG. 8 is a configuration in which all the operating CPUs are mounted on one base board, and data can be transferred between the operating CPUs 0, 2, 2, and 6 via the parallel bus 101-5.
[0009]
[Problems to be solved by the invention]
In general, the base board 100 does not have a module power switch or a module hot-swap function due to problems such as cost. For this reason, for example, in the case of the configuration shown in FIG. 7, even if an attempt is made to replace the failed CPU 0 while the system is operating when the CPU 0 has failed from the initial state, four CPU modules are mounted on the base board 100-4. Since the CPU is in operation, the CPU 0 cannot be replaced and maintained with the power turned off.
[0010]
Further, in the case of the configuration as shown in FIG. 8, in addition to the problem that the failed CPU module cannot be replaced while the system is operating, for example, when CPU 0 fails from the initial state and CPU 1 switches to the active CPU, Data transfer by the parallel bus cannot be performed between the CPU 2, CPU 4, and CPU 6 in other operating states.
[0011]
Furthermore, in the case of the configuration shown in FIGS. 7 and 8, if both of the CPUs in the pair, for example, CPU0 and CPU1 both fail, the operation is performed with three operating CPUs, and the original performance cannot be exhibited. End up.
[0012]
In view of the above problems, the present invention can always use a parallel bus capable of high-speed data transfer without any software processing between active CPUs, and further, a failed CPU while operating the system and continuing control. An object of the present invention is to provide a controller system that can be replaced and maintained.
[0013]
[Means for Solving the Problems]
In order to solve the above problems, a controller system according to the present invention is premised on a configuration in which a plurality of CPUs are provided and the CPUs are multiplexed to provide redundancy, and each CPU has a standby switching request message issuing means and state switching. Means.
[0014]
The standby switching request message issuing means issues a standby switching request message to the active CPU.
When receiving the standby switching request message, the state switching means switches from the operating state to the standby state.
[0015]
Each of the CPUs is, for example, divided into a plurality of linked groups, and each CPU stores in the linked group storage means which linked group it belongs to. The state switching means switches from the standby state to the operating state when the CPU multiplexed by itself enters the standby state, and the standby switching request message issuing means operates such as a failure of the CPU multiplexed by itself. When a standby switching factor occurs and the own CPU becomes a new operating state, the request message is issued to a CPU belonging to an interlocking group different from the own CPU.
[0016]
Further, when the CPU fails and all the CPUs that have multiplexed the failed CPUs are also in the failure state, the controller system enters the operation stop state.
According to the present invention, a CPU that is newly in operation due to a failure of a CPU that is multiplexed by itself, etc., places that CPU in a standby state by issuing a standby switching message to another CPU that is in an operating state. I can do it. Therefore, for example, an arbitrary CPU such as a CPU mounted on the same base board as itself can be set to be in an operating state.
[0017]
DETAILED DESCRIPTION OF THE INVENTION
An embodiment of the present invention will be described below.
FIG. 1 is a diagram showing a basic configuration of a controller system of the present embodiment. For comparison with the conventional example, the system shown in FIG. 8 includes eight CPUs and four I / Os, and four of them are in operation while the system is in operation. In this case, the basic connection configuration is the same as in FIG. become.
[0018]
The controller system shown in the figure has a configuration in which each module constituting the system is mounted on three base boards 10. The base board 10-1 includes CPU modules CPU 0, CPU 2, CPU 4 and CPU 6, and the base board 10-2. CPU modules CPU1, CPU3, CPU5 and CPU7 are mounted on the base board 10-3, and I / O modules I / O0, I / O1, I / O2 and I / O3 are mounted on the baseboard 10-3. Power is supplied from 10. In addition, a parallel bus 11 (11-1 to 11-3) for connecting each module in the same base board 10 and a serial bus 12 for serially connecting all the modules are provided, and status information to be described later is sent via the serial bus 12. Communicating.
[0019]
As shown in FIG. 1, the eight CPU modules constituting the system are CPU0, CPU2, CPU4 and CPU6 mounted on the base board 10-1, the interlocking group 1, and the CPU1 mounted on the baseboard 10-2. CPU3, CPU5 and CPU7 are defined as the interlocking group 2, and each CPU stores which interlocking group it belongs to. Each CPU is duplicated by a combination of CPU0 and CPU1, CPU2 and CPU3, CPU4 and CPU5, PU6 and CPU7, CPU of interlocking group 1 and CPU of interlocking group 2, and as an initial state, interlocking group 1 All the CPUs on the side are in the operating state and all the CPUs on the interlocking group 2 side are in the standby state.
[0020]
When the controller system enters the operating state, each CPU module cyclically transmits status information from the serial bus 12.
FIG. 2 shows a configuration example of this status information.
[0021]
In the case of the example of FIG. 2, this status information is 8-bit data, and each bit represents the state of the CPU module that is the transmission source. For example, in the case of FIG. 2, bit 7 indicates whether or not application software is running on the CPU module, bit 6 is a fatal failure such as a hardware failure, and bit 5 is a temporary failure. It is a flag indicating a minor failure. Bit 4 indicates whether the CPU module is currently operating or waiting.
[0022]
The CPU module cyclically receives status information transmitted on the serial bus 12 at regular intervals, thereby monitoring the status of other CPU modules and checking whether they are operating normally. From this status information, each CPU module can recognize the failure state and the active / standby state of other CPU modules.
[0023]
3 and 4 are diagrams showing processing when an abnormality occurs in the CPU module while the system is operating.
When an abnormality occurs in CPU 0 in the operating state, status information with bit 6 or bit 7 set to 1 is transmitted on serial bus 12 based on the content of the abnormality. The CPU 1 that is paired with the CPU 0 detects the failure of the CPU 0 from the status information, and switches from the standby state to the operating state as shown in FIG.
[0024]
In the state of FIG. 3, CPU1, CPU2, CPU4, and CPU6 are in an operating state, and data transfer through the parallel bus 11 cannot be performed between the CPU1 and other operating CPUs. Further, since CPU2, CPU4, and CPU6 are in an operating state, the power of the base board 10-1 cannot be turned off for replacement maintenance of the failed module CPU0.
[0025]
Therefore, the CPU 1 that has been switched to the operating state first checks the operating / standby states of the other CPU0, CPU2, CPU3, CPU4, CPU5, CPU6, and CPU7 from the status information of each CPU module on the serial bus 12. As a result, CPU 0 recognizes that it is in a failure state, CPU 2, CPU 4 and CPU 6 are in an operating state, and CPU 3, CPU 5 and CPU 7 are in a standby state.
[0026]
The CPU 1 that does not belong to the same interlocking group 2 as the CPU 1 determines that it does not match the interlocking switching group setting, and issues a standby switching request message from the serial bus 12.
[0027]
FIG. 4 shows the issuance of a standby switching request message by the CPU 1.
Since the CPU 1 belongs to the interlocking group 2, the CPU 2, the CPU 4, and the CPU 6 that are determined not to belong to the interlocking group 2 and are inconsistent with the interlock switching group setting are switched to the CPU 3, CPU 5, and CPU 7 of the interlocking group 2. As shown in FIG. 4, a standby switching request message is issued from the serial bus 12 to these CPU modules. The active CPU that has received this message forcibly switches to the standby CPU.
[0028]
The CPU 2, CPU 4, and CPU 6 that have received the standby switching request message shift from the operating state to the standby state. When the CPUs 3, 5, and 7 that are paired by duplicating the CPUs that are in the standby state detect that the paired CPUs are in the standby state from the status information on the serial bus 12, Is shifted from the standby state to the operating state.
[0029]
Thus, in a state after all the operating CPUs are switched to those belonging to the interlocking group 2, data transfer by the parallel bus 11-2 is possible between the operating CPUs. Since all of CPU2, CPU4, and CPU6 on the same baseboard 10-1 as the failed CPU0 are in a standby state, the power supply of the baseboard 10-1 is turned off to replace and maintain the failed CPU0 module. I can do it.
[0030]
Next, a case where both paired CPUs fail will be described.
As shown in FIG. 5, when both CPU 0 and CPU 1 are in a failure state, both the interlocking group 1 and the interlocking group 2 cannot be operated by four operating CPUs.
[0031]
When each CPU that monitors the operation / standby state of other CPUs detects that the CPU 0 and CPU 1 are in a failure state from the status information on the serial bus and recognizes that the linked CPU group operation cannot be executed, Each CPU enters an operation stop state. When entering the operation stop state, the CPU module stops the execution of the application program and the transfer of I / O data to put the system in the stop state. Further, the alarm LED in the CPU module is turned on, and the application program execution LED is turned off to notify the operator. As a result, the operator knows that the controller system has been stopped due to a failure, and can immediately perform maintenance.
[0032]
In the above-described embodiment, a controller system with a dual CPU is described. However, the present invention is not limited to this, and the CPU is tripled or more by expanding to interlocking groups 3, 4,. It can also be applied to configurations. In this case, various methods can be considered for selecting one of the linked groups in the standby state to be switched to the operating state. For example, the priority order of the linked group to enter the operating state is set (linked group 1, linked group 2,. , Etc.) or switch to the operating state in the order of network addresses (in order of large (small) network addresses).
[0033]
Further, in this embodiment, each CPU stores which linked group it belongs to and the other CPU, and based on this storage, it is determined whether the other CPU belongs to the same linked group as itself. In addition to such a method of storing the affiliation to the interlocking group, for example, it can be realized as a configuration for determining whether or not it belongs to the same interlocking group from its own network address from each CPU.
[0034]
Furthermore, in this embodiment, the interlocking group is set as a group mounted on the same base board. However, the present invention is not limited to such a setting of the interlocking group. An interlocking group can be arbitrarily set depending on the combination of CPUs to be operated.
[0035]
【The invention's effect】
According to the controller system based on the present invention, even when a failed CPU occurs, data can be transferred between the active CPUs by the parallel bus.
[0036]
Further, the failed CPU module can be replaced and maintained after the base board is powered off.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a basic configuration of a controller system according to an embodiment.
FIG. 2 is a diagram illustrating a configuration of status information.
FIG. 3 is a diagram illustrating switching of a standby CPU when a failed CPU occurs.
FIG. 4 is a diagram showing issuance of a standby switching request message by CPU 1;
FIG. 5 is a diagram showing a state when paired CPUs fail at the same time.
FIG. 6 is a diagram showing a general configuration of a controller system.
FIG. 7 is a diagram showing a controller system having a configuration in which all CPU modules are mounted on one base board.
FIG. 8 is a diagram showing a configuration in which all active CPU modules are mounted on one base board.
[Explanation of symbols]
10, 100 Base board 11, 101 Parallel bus 12, 102 Serial bus

Claims (2)

A controller having a plurality of CPUs and one or more CPUs, a plurality of base boards for supplying power to the mounted CPUs, and multiplexing the CPUs in units of the base boards to provide redundancy In the system,
Each CPU
Interlocking group storage means for storing what is mounted on the same base board among the CPUs as the same group and which interlocking group the self belongs to;
A standby switching request message issuing means for issuing a standby switching request message to the active CPU;
Upon receipt of the standby switching request message, a state switching means for switching from the operating state to the standby state, and
The state switching means switches from the standby state to the active state when the CPU that is multiplexed into the standby state enters the standby state, and the standby switching request message issuing means causes the operation / standby switching factor to occur and The controller system is characterized in that when the system is in an operating state, the active system / standby system is switched in units of the interlocking group by issuing the request message to a CPU belonging to an interlocking group different from the own CPU.   2. The controller system according to claim 1, wherein when the CPU fails and all the CPUs that multiplex the failed CPUs are also in a failure state, the system is put into an operation stop state.

Images