JP4724076B2 - Process control system - Google Patents

Description

  The present invention relates to a process input / output device of a process control device provided with a protection / drive circuit for a process operation end.

  The process control system operates a plant by operating an operation end (process operation end) of the plant. Conventionally, a protection / end driving circuit for a process operation end constituting a part of the process control system has been constituted by a relay circuit or the like. Further, software necessary for control is stored in a nonvolatile fixed memory element. This is because it is necessary to continue the operation even when the process control device is stopped, to recover from the power failure of the process control device in a short time, and to eliminate the possibility of erroneous circuit mixing.

  However, the conventionally used circuit has poor maintainability. For example, when the circuit is changed, the relay circuit needs to be changed in wiring. In addition, it has been necessary to rewrite the contents of the nonvolatile fixed memory element and replace the memory element itself.

  In addition, since such a circuit has poor visibility of the operation state, it is difficult to grasp the state and investigate the cause when the plant is abnormal. For example, in order to check the signal in the circuit, it was necessary to follow the actual wiring, timer, and relay operations.

  Furthermore, the manufacturing process of such a circuit requires a large number of wiring steps, and there is a high possibility of erroneous wiring mixing. In order to prevent miswiring, the inspection man-hours must be increased.

  In order to facilitate remodeling of the software stored in the nonvolatile fixed memory element and confirmation of the operation state, it is also conceivable to store the software in the nonvolatile rewritable memory element. However, such a memory device has a problem in reliability. For example, data may be lost due to electrical stress during rewriting.

  The present invention is a process control apparatus that improves operational state visibility, ease of circuit change, and maintainability while ensuring operational reliability and non-volatility, and also reduces wiring man-hours and inspection man-hours for circuit manufacturing. An object of the present invention is to provide a process input / output device.

  In the present invention, the basic circuit that has been conventionally constituted by the relay circuit is made into software, and the software is stored in the nonvolatile rewritable memory element. While this software can be changed by a maintenance management tool as necessary, a rewrite permission switch is provided to ensure safety in order to prevent erasure due to an erroneous operation.

  The configuration of the present invention will be described more specifically as follows.

As a first aspect of the present invention, in a process control system for operating a plant by operating an operation end of the plant,
A plurality of process input / output devices for performing input processing for receiving input of state information indicating the state of the plant, and output processing for instructing the operation end of the operation content of the operation end separately determined;
A process control device that is connected to the plurality of process input / output devices by a bus and determines the operation content based on the status information received by the plurality of process input / output devices;
A maintenance management device for maintaining and managing the plurality of process input / output devices and the process control device;
With
The process input / output device is
A protection drive condition processing program for generating a protection drive signal when the state information satisfies a predetermined condition, and when the protection drive signal is generated by executing the protection drive condition processing program, the process control device determines An input / output program including an operation end drive program for outputting a lock signal corresponding to the protection drive signal to the operation end regardless of the operation details performed, and defining the contents of the input process and the output process A nonvolatile rewritable memory element storing the input / output program
An arithmetic unit for executing the input / output program;
Including
The maintenance management device accepts rewriting of the storage content of the nonvolatile rewritable memory element, and sends the rewriting content to the process input / output device via the process control device and the bus,
The arithmetic unit of the process input / output device receives a rewrite content from the maintenance management device, and executes a rewrite process for storing the rewrite content in the nonvolatile rewritable memory element.
A process control system is provided.

The non-volatile rewritable memory element further stores a rewrite count value indicating the number of times the rewrite processing has been performed so far, and the maintenance monitoring device can perform the non-volatile rewrite by the arithmetic unit. When the rewrite of the storage contents of the type memory element is permitted, and when the above rewrite is performed, the rewrite count value is confirmed, and as a result of the confirmation, the rewrite count value at that time is equal to or less than a separately defined limit count only together sending the content of the rewriting in the process input and output device, it may be intended to update the number of rewriting times value.

  The process input / output device may output a predetermined operation content to the operation end while the rewriting process is being performed.

  The process input / output device has a control permission condition separately defined for each operation end, and outputs the operation content to the operation end only when the operation content input from the process control device satisfies the control permission condition. It is preferable that

  At least one of the maintenance monitoring device and the process input / output device preferably includes a restriction mechanism that restricts execution of the rewriting process.

  The operation will be described.

  The process input / output device receives input of state information indicating the state of the plant. The process control device determines the operation content based on the status information received by the process input / output device. The process input / output device instructs the operation end of the determined operation content of the operation end. In this case, if the process input / output device outputs the operation content to the operation end only when the operation content input from the process control device satisfies the control permission condition, the process input / output device can cope with the abnormality of the process control device.

  Such input / output processing performed by the process input / output device can be realized by the arithmetic unit executing the input / output program. If the input / output program is stored in the non-volatile rewritable memory element, the maintenance monitoring device can check the operation state of the input / output device by reading the contents. Moreover, it can be rewritten as needed.

  When the input / output program is rewritten, the maintenance monitoring apparatus first confirms the rewrite count value stored so far in the nonvolatile rewritable memory element. As a result of the confirmation, the rewrite process is performed and the rewrite count value is updated only when the rewrite count value at that time is equal to or less than a separately defined limit count. By doing so, the reliability of data retention can be ensured.

  While the rewriting process is being performed, the process input / output device can output a predetermined operation content to the operation end to prevent the plant state from being disturbed.

  Depending on the specific program and circuit configuration, input / output from the process control device to the process input / output device is further stopped, and status information and the like are input from the operation end immediately before rewriting. If the contents are maintained, reliability and safety can be further ensured.

  A situation in which the rewriting process is erroneously performed can be prevented by providing a limiting mechanism.

  As described above, according to the present invention, a process input / output device having high reliability, maintainability, and high visibility can be obtained. Further, the number of wiring steps, wiring mistakes, and inspection steps in the manufacturing process can be reduced.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Process control system of the present embodiment, as shown in FIG. 1, and the process control device 1, a bus 2, and one or more process input and output device 3, the coercive Mamoru監 vision device 6, from. The process operation end s itself is owned by the process itself to be controlled.

  The process operation end s is an operation end of an auxiliary machine (for example, a one-way rotary auxiliary machine, a motor operated valve, an electromagnetic valve, etc.) necessary for operating the plant, and is assigned to each auxiliary machine. The process operation end s can change the state of the auxiliary machine in accordance with an operation command from the process input / output device 3. At the same time, the operation state of the auxiliary machine is output to the process input / output device 3.

[Process control device 1]
The process control device 1 is a device that collectively manages the operation of the process operation terminal s. As shown in FIG. 2, the process control apparatus 1 includes a CPU 101, a volatile rewritable memory element 102, a bus 103 that connects them, and the like. The operation management program software (process control program 7) executed by the CPU 101 is stored in the volatile rewritable memory element 102.

  During plant operation, the process control device 1 outputs an operation command to each process input / output device 3 by executing the process control program 7. Various pieces of information necessary for determining the operation command are input as state information from the process input / output device 3 to which the process operation terminal s to be controlled is assigned.

[Process input / output device 3]
The process input / output device 3 is located between the process control device 1 and the process operation end s, and performs input / output processing of various control signals. The process input / output device 3 is provided for each process operation end s. The process input / output device 3 functionally includes a normal drive condition processing circuit 30, a protection drive condition processing circuit 31, and an operation end drive circuit 32 (see FIG. 4).

  The normal drive condition processing circuit 30 generates a drive condition (drive permission condition) of the auxiliary equipment necessary for normal operation of the plant and determines whether or not the drive permission condition is satisfied. is there.

  The protection drive condition processing circuit 31 is for driving the process operation end s in order to protect the main equipment of the plant when any abnormality occurs. When an abnormality occurs, the protection drive condition processing circuit 31 ignores the drive permission condition described above and forcibly instructs the operation end drive circuit 32 to drive.

  The operation end drive circuit 32 is a circuit that outputs a drive signal to the process operation end s of the auxiliary machine. The operation end drive circuit 32 normally outputs a drive signal when the drive condition is satisfied as a result of the determination by the normal drive condition processing circuit 30. However, when any abnormality occurs, a drive signal is output in accordance with a drive instruction from a protection drive condition processing circuit 31 described later.

  As shown in FIG. 2, the process input / output device 3 according to the present embodiment specifically includes an MPU 301, a nonvolatile rewritable memory element 302, a bus 303, and an operation end drive circuit 32. The normal drive condition processing circuit 30 and the protection drive condition processing circuit 31 described above are realized by the MPU 301 executing the process input / output program 8 stored in the nonvolatile rewritable memory element 302. As a result of adopting such a configuration, in this embodiment, the state change of the main device is constantly monitored, and when any abnormality occurs, the main device is prevented from being damaged or burned out, and the state is quickly shifted in a safe direction. Can do.

Incidentally, the process input and output program 8, rewriting the coercive Mamoru監 vision device 6, the monitor is configured to be. The storage form of the process input / output program 8 in the nonvolatile rewritable memory element 302 is in consideration of the rewriting. This will be described in detail later with reference to FIG.

  The process control procedure by the process control device 1 and the process input / output device 3 will be described below with reference to FIGS.

  A state signal 11a indicating the state of the process operation end s is input to the process input / output device 3 from the process operation end s. The process input / output device 3 outputs the state signal 11a as it is as the condition signal 9 to the process control device 1 (see FIG. 4). The condition signal 9 is a signal that is used as a judgment material for the process control device 1 to analyze the state of the plant, and is output from all the process input / output devices 3 to the process control device 1.

In addition to this, the process input / output device 3 receives an operation end drive permission signal 11b from the process operation end s. The operation end drive permission signal 11b serves as a reference and a condition for determining whether or not an operation end control signal 10 to be described later can normally operate the process operation end s. The actual operation end drive permission signal 11b includes, for example, an operation state of another related process operation end s, a plant state signal, or the like. The process input / output device 3 takes in the operation end drive permission signal 11 b and stores it in the nonvolatile rewritable memory element 302 .

  The process control device 1 analyzes the state of the plant based on the contents of the condition signal 9 and the like. As a result of the analysis, for a process operation end s that needs to perform some operation, an operation end control signal 10 is output to the process input / output device 3 associated with the process operation end s.

  The process input / output device 3 temporarily stores the input operation end control signal 10 in the nonvolatile rewritable memory element 302. Then, the normal drive condition processing unit 30 determines whether or not the content of the operation end control signal 10 input at this time satisfies the criteria and conditions indicated by the operation end drive permission signal 11b. If the criterion is satisfied as a result of the determination, the operation end control signal 10 is output to the operation end drive circuit 32. The operation end drive circuit 32 outputs an operation end drive signal 12 to the process operation end s so as to drive the process operation end s based on the operation end control signal 10.

[Coercive Mamoru監 vision device 6]
Coercive Mamoru監 vision device 6 is for performing the process input and output device 3 of the maintenance and monitoring. Coercive Mamoru監 vision device 6, as shown in FIG. 2, CPU 601, memory 602, bus 603, and a monitor 605. Then, it is connected to the process control device 1 and / or the process input / output device 3. The CPU 601 realizes various functions for maintenance and monitoring by executing a program stored in the memory 602. For example,-holding Mamoru監 vision device 6, via the process control system 1, by accessing the process input and output device 3, a program stored in the nonvolatile rewritable memory device 302, data A rewriting function is provided. In addition, a program stored in the non-volatile rewritable memory element 302 and a function of acquiring information on the operation state of the process input / output device 3 and displaying the information on the monitor 605 are provided. Furthermore, a rewrite count management circuit 26 that counts the number of times the nonvolatile rewritable memory element 302 has been rewritten is provided. The rewrite count management circuit 26 is also realized by the CPU 601 executing a program stored in advance in the memory 602, as in the case of other functions.

Hereinafter will be described with reference to FIGS. 5-9 the operation of the-holding Mamoru監 vision device 6. Here, the operation will be described separately for each content.

(1) Display coercive Mamoru監 vision device 6 of the operating state of the process input and output device 3, acquires the information indicating the operating state of the process input and output device 3, a control logic diagram this is displayed on the monitor 605. The information, as shown in FIG. 5, by way of the process control device 1 (operation state signal 14), is obtained caught process input and output device 3 or al.

(2) in the memory 602 of the update coercive Mamoru監 vision device 6 of the process input and output program 8, stores the rewriting program 22 is a new process input and output program in advance. As shown in FIG. 6, the rewriting program 22 is divided into N groups (group 22-1 to group 22-N). Moreover, coercive Mamoru監 vision device 6 is provided with a rewrite count management circuit 26 for counting the number of times that the rewriting process.

  On the other hand, the non-volatile rewritable memory element 302 is divided into a memory area 17 for storing a program and a rewrite count area 21 for holding the number of rewrites, as shown in FIG. The memory area 17 is further divided into N small areas (area 17-1 to area 17-N). In each area, the above-described rewrite program 22 is written in groups. That is, the group 22-1 is stored in the area 17-1, and the group 22-2 is stored in the area 17-2.

  The program is rewritten by transferring the new program to the nonvolatile rewritable memory 302 after the process input / output device 3 is shifted to the rewrite mode.

That is, the coercive Mamoru監 vision device 6 outputs a program rewrite command 1 3 to the process input and output device 3 (see FIG. 5). The process input / output device 3 to which the program rewrite command signal 13 is input shifts to the rewrite mode. Thereafter, the transfer of a new program to be subsequently performed is basically performed in units of groups.

When rewriting the process input and output program 8 part, coercive Mamoru監 vision device 6, only the group that contains the moiety that is the rewritten among the rewrite program 22, to store the corresponding group Transfer to area. This will be described in detail below with reference to FIGS.

Coercive Mamoru監 vision device 6 starts the rewriting process, as shown in FIG. 7, first, to access the number of times of rewriting count area 21 of the non-volatile rewritable memory 302, to check the number of rewriting times so far. After confirming the number of rewrites, program transfer starts. In this case, first, it is determined for each group whether or not it is a target of rewriting. This determination is performed by determining whether or not the user has designated in advance as the target of the rewriting process. If it is not the target of rewriting, the process proceeds to the determination for the next group. If it has been rewritten, the group is transferred to the corresponding area. In the example of FIGS. 6 and 7, only the group 22-2 is rewritten.

  When the determination for all the groups has been executed, the rewrite count management circuit 26 increments the rewrite count by one. Then, the new number of rewrites is stored in the rewrite number count area 21.

When the entire process input / output program 8 is rewritten, the same processing is performed to sequentially transfer all the groups constituting the rewrite program 22 (see FIGS. 8 and 9). That is, the coercive Mamoru監 vision device 6 first, transfers the group 22-1 of the rewriting program 22 in the area 17 over the first non-volatile rewritable memory device 302. When the transfer of the group 22-1 is completed, the group 22-2 is transferred to the area 17-2. Similarly, the remaining groups 22-3 to 22-N are sequentially transferred to the memory areas 17-3 to 17-N.

  The same applies to the count of the number of rewrites and the update of the rewrite number count area 21 by the rewrite number management circuit 26.

In addition, as a result of checking the number of times of rewriting, if the number of times specified separately (1000 in the present embodiment) is exceeded, whether the rewriting is the entire process input / output program 8 or a part thereof. to that effect regardless it is displayed on the monitor 605 of the coercive Mamoru監 vision device 6, to stop the rewriting. By providing such a limit on the number of times of rewriting, the reliability of the stored contents of the nonvolatile rewritable memory element 302 can be maintained. The limit number is determined according to the failure rate of the memory used as the nonvolatile rewritable memory element 302 and stored in the memory 602 of the maintenance monitoring device 6.

  While the program is being transferred (or when a rewrite permission switch described later is permitted to be written), the process control device 1 and the process input / output device regardless of whether the rewriting is the whole or part of the process input / output program 8. Data input / output with 3 is temporarily stopped. Further, the input from the process operation end s to the process input / output device 3 is also stopped. On the other hand, the process input / output device 3 holds the operation end drive signal 12 at a value (or a predetermined value) immediately before the start of the writing process. Thereby, the influence on the plant by rewriting can be suppressed.

  Although not described in particular so far, in the present embodiment, a rewrite permission switch is provided so that the process input / output program 8 and the like are not lost due to an erroneous operation. The rewrite permission switch can be realized by either hardware or software. An example of each is shown in FIG.

The rewrite permission switch 28 provided in the main body of the process input / output device 3 is configured by hardware. Normally, the rewrite permission switch 28 is set to the “non-permitted” position. In this state, from the coercive Mamoru監 vision device 6 comes rewriting command 1 3, it can not be rewritten data in the nonvolatile rewritable memory 302. Program nonvolatile rewritable memory 302, when rewriting the data before sending the rewrite command 1 3, previously switched advance rewrite permission switch 28 to manually "permission" position.

Rewriting permission switch 27 provided on the holding Mamoru監 vision device 6 are those that are implemented in software. The rewrite permission switch 27 is adapted unless input is separately determined keywords, limits the function of holding Mamoru監 vision device 6. Here, unless this keyword is input, a rewriting program or the like to the process input / output device 3 cannot be transmitted.

  In the example of FIG. 10, the rewrite permission switch 28 (hard switch) and the rewrite permission switch 27 (soft switch) are used in combination for more certainty. Accordingly, when the lock is not released in either one, the data in the nonvolatile rewritable memory element 302 cannot be rewritten.

  In the process control system of the embodiment described above, since the circuit is softwareized, a relay circuit or the like is not required, and the process input / output device, and thus the process control system as a whole can be downsized.

  By reading the operation signal of the process input / output device or the like, the operation state can be easily confirmed. Such improvement in the visibility of the plant control operation leads to an improvement in plant monitoring performance and a quick response to the plant abnormality.

  Since a non-volatile rewritable memory element is used, software can be rewritten in response to a circuit change, and the maintainability is high. Furthermore, software is not lost during a power failure, so there is no need to rewrite the software after a power failure. If the number of rewrites is small, the possibility of an error during writing is reduced, so that the reliability is increased. By providing a limit on the number of rewrites, the reliability of software maintenance is further increased.

  By providing the write permission / non-permission switch, the software is not inadvertently changed, so that process control is highly safe.

Since the previous value is output during the software update process, the safety is high without causing disturbance to the plant even during the update. In the above-described embodiment, the function of the process input / output device 3 is provided. Of the (circuit), only the normal drive condition processing circuit 30 and the protection drive condition processing circuit 31 are made into software. However, the operation end drive circuit 32 may be implemented as software.

  An operation end drive permission signal 11b input from the process operation end s is used as a reference and a condition for determining whether an operation end control signal 10 to be described later can normally operate the process operation end s. Was used. However, these criteria and conditions may be separately input to the process input / output device in advance.

The “operation end” in the claims corresponds to the process operation end s in the above embodiment. “Status information” corresponds to the content included in the status signal 11a (condition signal 9). The “operation content” corresponds to the content of the operation end control signal 10. "Input and output program" corresponds to the process input and output for the program 8. The “nonvolatile rewritable memory element” corresponds to the nonvolatile rewritable memory element 302. The “arithmetic unit” corresponds to the MPU 301. The “rewrite count value” corresponds to a value stored in the rewrite count area 21. The “control permission condition” corresponds to a reference and a condition stored in the nonvolatile rewritable memory element 302 determined according to the operation end drive permission signal 11b. The “restriction mechanism” corresponds to a rewrite permission switch.

It is a figure which shows the whole structure of the process control system containing the process input / output apparatus 3 which is embodiment of this invention. Process input and output device 3, the process control device 1 is a diagram showing an internal structure of a coercive Mamoru監 vision device 6. It is a figure which shows the signal transmitted / received between each part. It is the figure which showed the outline | summary of the process of the process input / output apparatus 3 based on the flow of a signal. Is a diagram showing the flow of signals in the protection and monitoring operation by the coercive Mamoru監 vision device 6. FIG. 6 is a diagram showing a state when a part of a memory area 17 is rewritten. FIG. 6 is a diagram showing a procedure for rewriting a part of a memory area 17. FIG. 4 is a diagram showing how the entire memory area 17 is rewritten. FIG. 10 is a diagram showing a procedure for rewriting the entire memory area 17. 3 is a diagram showing rewrite permission switches 27 and 28 of a nonvolatile rewritable memory element 302. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Process control device, 2 ... Bus, 3 ... Process input / output device, 6 ... Maintenance / monitoring device, 7 ... Process control program, 8 ... Process input / output program, 9 ... Condition signal, 10 ... Operation end control signal , 11a ... Status signal, 11b ... Operation end drive permission signal, 12 ... Operation end drive signal, 13 ... Program rewrite command, 14 ... Operation status signal, 15 ... Program rewrite command, 16 ... Operation status signal, 17 ... Memory area, DESCRIPTION OF SYMBOLS 21 ... Rewrite count area, 22 ... Rewrite program, 27 ... Rewrite permission switch, 28 ... Rewrite permission switch, 30 ... Normal drive condition processing circuit, 31 ... Protection drive condition processing circuit, 32 ... Operation end drive circuit, 101 ... CPU , 102 ... volatile rewritable memory element, 103 ... bus, 301 ... CPU, 302 ... nonvolatile rewritable memory element, 303 ... bus, 01 ... CPU, 602 ... memory, 603 ... bus, 605 ... monitor, s ... process operations end

Claims (4)

In the process control system that operates the plant by operating the operation end of the plant,
A plurality of process input / output devices for performing input processing for receiving input of state information indicating the state of the plant, and output processing for instructing the operation end of the operation content of the operation end separately determined;
A process control device that is connected to the plurality of process input / output devices by a bus and determines the operation content based on the status information received by the plurality of process input / output devices;
A maintenance monitoring device for maintaining and managing the plurality of process input / output devices and the process control device;
With
The process input / output device is
A drive permission condition for the operation end necessary for normal operation of the plant is generated, a program for determining whether or not the drive permission condition is satisfied, and the state information satisfies a predetermined condition And a nonvolatile rewritable memory element storing an input / output program including a protection drive condition processing program for generating a drive instruction ;
An arithmetic unit for executing the input / output program;
When the drive instruction is generated by executing the protection drive condition processing program, an operation terminal that outputs a drive signal corresponding to the drive instruction to the operation terminal regardless of the operation content determined by the process control device A drive circuit ;
Including
The maintenance monitoring device
Accepting the rewriting of the contents of the nonvolatile rewritable memory device, via the process control equipment, it sends the contents of the rewrite to the process input and output devices,
The arithmetic unit of the process input / output device is:
A process control system for receiving a rewrite content from the maintenance monitoring device and executing a rewrite process for storing the rewrite content in the nonvolatile rewritable memory element. The nonvolatile rewritable memory element further stores a rewrite count value indicating the number of times the rewrite processing has been performed so far.
The maintenance monitoring device
When the rewrite is performed, the rewrite count value is confirmed, and the content of the rewrite is sent to the process input / output device only when the rewrite count value at that time is equal to or less than a predetermined limit as a result of the confirmation. The process control system according to claim 1, wherein the rewrite count value is updated. The process input / output device is
3. The process control system according to claim 1, wherein a predetermined operation content is output to the operation end while the rewrite process is performed. 4. The process input / output device is
A control permission condition separately defined for each operation end is provided, and the operation content is output to the operation end only when the operation content input from the process control apparatus satisfies the restriction mechanism. The process control system according to any one of claims 1 to 3.

Images