JP6145987B2 - Programmable controller, programmable controller data backup method, programmable controller activation method - Google Patents

Description

  The present invention relates to a programmable controller that controls equipment, a data backup method that backs up data stored in a storage unit of the programmable controller, and a startup method of the programmable controller.

  A programmable controller is known as one of control devices. In the programmable controller system, one or more programmable controllers are connected to a higher-level management device, and each programmable controller controls a plurality of controlled devices. Therefore, the programmable controller must receive a control command from a higher-level management device, analyze the control command, control the lower-level controlled device, and hold parameters and status information required for control.

  In addition, in the programmable controller system, the lower-level controlled devices often have power. Therefore, the programmable controller system as a whole must perform various control operations safely and reliably by appropriately controlling the controlled devices. Don't be. For example, even if an error occurs during the operation of the programmable controller system, the programmable controller must back up data indicating the operation state at that time and safely stop the controlled device. In addition, when the error is recovered, the programmable controller should rearrange the backed up data and quickly return to the original operating state.

  For example, Patent Document 1 describes a technique in which a processor (central processing unit) backs up part of data stored in an SRAM to a flash memory when a drop in power supply voltage is detected.

JP 2000-305610 A

  However, in the technique of Patent Document 1 described above, the processor executes all processes related to backup through its own program. Therefore, when an error occurs in the processor, it is difficult to execute a backup process of reading the information from the backup target memory storing the information to be backed up and writing the information in the backup destination backup memory.

  The present invention has been made in view of such problems, and an object thereof is to provide a programmable controller, a data backup method thereof, and a startup method of the programmable controller that can devise a backup process and reliably execute the backup process.

In order to solve the above problems, a programmable controller according to claim 1 includes a backup storage unit, a backup storage unit, a central processing unit and an access element that can access the backup storage unit and the backup storage unit, An error detection unit that detects an abnormality in the operation of the processing unit, and the access element stores the data in the backup storage unit in the backup storage unit when an error in the operation of the central processing unit is detected by the error detection unit. It is configured to evacuate and record the detected abnormality factor in a predetermined area of the backup storage unit.

According to the second aspect of the present invention, the access element is configured to execute reading of data in the backup target storage unit and writing to the backup storage unit in the same access cycle.
The invention according to claim 3 configures the access element to stop the bus access of the central processing unit when an abnormality in the operation of the central processing unit is detected.

The invention according to claim 4 refers to a predetermined area of the backup storage unit at the time of activation, and records that an error in the operation of the central processing unit is detected by the error detection unit in the predetermined area The central processing unit is configured to enter a standby mode and wait for a predetermined instruction from the outside.

In the invention according to claim 5 , the predetermined instruction is a restoration instruction,
Upon receiving the restoration instruction, the central processing unit is configured to restore the data stored in the backup storage unit to the backup storage unit.

In the invention according to claim 6 , the predetermined instruction is a backup data transmission instruction,
When receiving the backup data transmission instruction, constituting the central processing unit to transmit all or part of the data stored in the backup storage unit to the outside.

The invention according to claim 7 is a data backup method for backing up the data stored in the backup storage unit of the programmable controller having the backup storage unit and the backup storage unit to the backup storage unit, and is mounted on the programmable controller. When an abnormality in the central processing unit is detected, an access element different from the central processing unit saves the data in the backup storage unit to the backup storage unit, and the detected abnormality factor is stored in the backup storage unit. Record in a predetermined area.

The invention according to claim 8 is a programmable controller that backs up data stored in a backup storage unit in response to a predetermined abnormality to a backup storage unit and records a predetermined abnormality factor in a predetermined area of the backup storage unit. Prior to execution of control after startup, the programmable controller refers to a predetermined abnormality factor, and stays in a standby mode if the referenced abnormality factor is an abnormality related to the central processing unit of the programmable controller. .

  In the present invention, when an abnormality of a central processing unit mounted on a programmable controller is detected, an access element different from the central processing unit backs up data stored in a backup storage unit to a backup storage unit. By doing so, it is possible to provide a highly reliable programmable controller that can reliably execute backup processing even when an abnormality occurs in the central processing unit.

It is explanatory drawing which showed the schematic relationship of each apparatus which comprises the programmable controller system which concerns on this invention. It is a block diagram which shows the schematic structure of the main circuit of the programmable controller which concerns on this invention. It is the flowchart which showed the flow of the process of backup of this invention. 6 is a timing chart showing detailed timing of data transfer in backup processing. It is the flowchart which showed the flow of the process at the time of restart (at the time of starting).

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. Specific numerical values and the like shown in the embodiment are merely examples for facilitating understanding of the invention, and do not limit the present invention unless otherwise specified. In the present specification and drawings, elements having substantially the same function and configuration are denoted by the same reference numerals, and redundant description is omitted, and elements not directly related to the present invention are not illustrated. To do.
(Programmable controller system 100)
FIG. 1 is an explanatory diagram showing a schematic relationship between devices constituting the programmable controller system 100. The programmable controller system 100 includes a management device 110, one or more (one or more) programmable controllers 120, and one or more (one or more) controlled devices 130. Further, the management device 110 and the one or more programmable controllers 120 are connected by a network wiring 140 by Ethernet (registered trademark) such as a gigabase, for example. The programmable controller 120 and the one or more controlled devices 130 are connected through, for example, a dedicated connection wiring 142.

  The management device 110 gives instructions to one or more programmable controllers 120, reads status information from one or more programmable controllers 120, and performs process management in the entire programmable controller system 100 and the like.

  The programmable controller 120 includes a plurality of modules such as a power supply module, a CPU module, an input / output module, and a communication module, and is also called a PLC (Programmable Logic Controller). For example, the CPU module has a control program for sequence control generated through a ladder diagram or the like, and is based on a control command from the management apparatus 110 and a sensor detection result of the controlled device 130 input through the input / output module. To control the controlled device 130.

  The controlled device 130 includes a sensor that detects various states in FA (Factory Automation), and an electric device such as an electric motor and an encoder that operate according to the detection result of the sensor.

  Such a programmable controller system 100 can be applied to various control objects. For example, when the programmable controller system 100 is applied to a production execution system (MES), the programmable controller 120 is connected to a production device such as a film unit as a controlled device 130.

The programmable controller 120 reads the operation state of the production device from the input / output module and the like, and controls the rotation of the electric motor in the production device through a motor driver or the like. The management device 110 collects information for each programmable controller 120 and transmits a control command. In this way, the programmable controller 120 can comprehensively execute production support management such as process management, quality management, and manufacturing amount management as the entire system 100.

In the following, a specific operation of the programmable controller 120 will be described with respect to backup processing when an abnormality occurs in which the processor 170 of FIG. 2 provided in the programmable controller 120 cannot normally execute the program.
(Backup processing when an abnormality occurs in the processor 170)
FIG. 2 is a block diagram illustrating a schematic configuration of the main circuit 154 of the programmable controller 120. The main circuit 154 includes a processor 170 (central processing unit), a first communication element 172, a first memory (dedicated memory) 174, a common bus 176, an access element 178, and a WDT (watchdog timer) error detection element. (Error detection unit) 179, second communication element 180, second memory (memory to be backed up) 182, and third memory (backup memory) 184 are configured.

  The processor 170 is composed of a semiconductor integrated circuit including a central processing unit (CPU), a ROM storing programs, and the like, and has a bus master function. The processor 170 controls the entire main circuit 154 and controls one or more controlled devices 130 based on a control program for sequence control held in the ROM.

  The first communication element 172 communicates with the management apparatus 110 and other programmable controllers 120 through the network wiring 140 by Ethernet (registered trademark) such as Gigabase. The first memory 174 is a volatile SDRAM that is directly connected to the processor 170 (not connected through the common bus 176), and functions as a work area of the processor 170. The first memory 174 stores at least RAS (Reliability, Availability, Serviceability) information such as a communication state and abnormality history in communication with the management apparatus 110 and other programmable controllers 120.

The access element 178 is configured by an integrated circuit such as a PGA (Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit) connected to the common bus 176, and performs logical calculation in the main circuit 154. The access element 178 has a bus master function, and can access the second memory 182 and the third memory 184 through the common bus 176, and executes a bus access process only with the hardware logic incorporated in the access element 178. it can. That is, the access element 178 is an element that can incorporate hardware logic in a programmable manner, and the actual state of the element is a hardware logic device in which only logic circuits are integrated. Therefore, the access element 178 does not execute processing while referring to a program such as a machine language, and can access the bus without the intervention of the program (the access element 178 is also simply referred to as a device or a DMA device).

  The WDT error detection element 179 is an element that monitors whether or not the processor 170 is operating normally. The WDT error detection element 179 receives a signal (watchdog signal) periodically sent from the processor 170 and passes a predetermined period. Even when the watchdog signal is not received, it is determined that some abnormality has occurred in the processor 170 such as a program hang-up, and an error detection signal is output to the access element 178.

  The second communication element 180 communicates with the controlled device 130 through the dedicated connection wiring 142. The second memory 182 is a volatile and relatively high speed SRAM connected to the common bus 176. The second memory 182 stores at least information indicating the operation state of the controlled device 130 acquired through the input / output module, such as RAS information such as a communication state and abnormality history in communication with the controlled device 130.

The third memory 184 is a nonvolatile RAM connected to the common bus 176. The third memory 184 is used to back up part or all of the data stored in the first memory 174 and the second memory 182. Therefore, it has a function of retaining data even at least while a power supply (not shown) is turned off. Here, a non-volatile RAM is cited, but a volatile RAM that can hold the stored contents of the memory using a built-in or external capacitor or the like can also be used. Hereinafter, a flow of a backup coping method in which backup is performed by each functional unit of the main circuit 154 when the WDT error detection element 179 detects an abnormality related to the processor 170 will be described.
(Solution for backup)
FIG. 3 is a flowchart showing a processing flow of the backup coping method when the processor 170 is abnormal. The WDT error detection element 179 receives the watchdog signal from the processor 170 as described above, determines that the processor 170 is operating normally as long as the watchdog signal is received during a predetermined period, and performs monitoring processing. Is repeated (NO in S1). On the other hand, when the WDT error detecting element 179 does not receive the watchdog signal even after a predetermined period has elapsed, it is determined that some abnormality has occurred in the processor 170 (YES in S1).

If the WDT error detection element 179 determines that some abnormality has occurred in the processor 170, it outputs an error detection signal to the access element 178 (S2).
When receiving the error detection signal from the WDT error detection element 179, the access element 178 stops the elements other than the access element 178, the second memory 182 and the third memory 184 (S3). More specifically, when the access element 178 receives an error detection signal from the WDT error detection element 179, it provides a reset signal to the processor 170, the first communication element 172, and the second communication element 180 to reset it. Alternatively, the access element 178 may give a bus use right acquisition request signal to the processor 170, the first communication element 172, and the second communication element 180 so as to release the bus, and deprive the bus access right of each element. . Alternatively, the access element 178 may give a bus use right acquisition request signal to the processor 170 to release the bus, and the first communication element 172 and the second communication element 180 may be reset by giving a reset signal. That is, when receiving an error detection signal from the WDT error detection element 179, the access element 178 acts to stop the bus access of each element (the process of step S3 including these embodiments, that is, the bus access of each element is stopped). (This process is also called exception handling.)

  Subsequently, the access element 178 transfers the data requiring backup stored in the second memory 182 to the third memory 184 in order to back up the data to be backed up (S4). Note that the address and size of data to be backed up in the second memory 182 and the address to be stored in the third memory 184 are set in advance in the register (not shown) of the access element 178 by the processor 170. It shall be.

  At this time, the access element 178 is connected to the second memory 182 and the third memory 184 through the common bus 176, and the access element 178 alone is received without receiving a control command from the processor 170 or leaving the processing to the processor 170. Transfer data.

  The access element 178 can arbitrarily set a logic circuit and its operation timing. Therefore, the access element 178 can generate a control signal to the second memory 182 and the third memory 184 at an appropriate timing based on the error detection signal output from the WDT error detection element 179. Control signals to the second memory 182 and the third memory 184 will be described in detail later.

  In this way, the data in the second memory 182 is transferred to the third memory 184. At this time, the data transfer from the second memory 182 to the third memory 184 is realized only by a logic circuit (hardware logic) incorporated in the access element 178 without involving the processor 170. Therefore, as compared with the conventional case where the processor 170 is involved in the backup process, the backup process can be reliably executed even if an abnormality occurs in the processor 170.

When the process of step S4 ends, the access element 178 records in the error factor recording area of the third memory 184 that the backup process is an abnormality detected by the WDT error detection element 179 (S5).

Subsequently, step S6 will be described. The process of step S6 is realized by the following (i) to (iii) according to the process of step S3.
(I) If the access element 178 receives an error detection signal from the WDT error detection element 179 and provides a reset signal to the processor 170, the first communication element 172, and the second communication element 180 in step S3, step S5 Subsequently to the access element 178, the reset output to each element is canceled and restarted.
(Ii) In step S3, when a request signal for acquiring the bus use right is given to each element so that the access element 178 deprives the bus access right of each element, the access element 178 follows the step S5. The output of the usage right acquisition request signal is canceled and a reset is temporarily given to each element to restart.
(Iii) When a request signal for acquiring the bus use right is given to the processor 170 so that the access element 178 releases the bus in step S3, and a reset signal is given to the first communication element 172 and the second communication element 180 Subsequently to step S5, the access element 178 cancels the output of the bus use right acquisition request signal given to the processor 170, temporarily gives a reset, and restarts the processor 170. In parallel with this, the access element 178 cancels the output of the reset signal to the first communication element 172 and the second communication element 180.
(Restart process)
FIG. 5 is a flowchart showing the flow of restart processing. The restarted processor 170 refers to the error factor recording area of the third memory 184 in order to grasp how it was restarted during the initialization process (S11). If the referenced error factor is not an abnormality detected by the WDT error detection element 179 (if it is not an abnormality that hinders the execution of the program of the processor 170), the processor 170 directly takes at least damage related to the abnormality. There may be an abnormality in other parts. For this reason, the processor 170 performs initialization processing for the entire main circuit 154, then shifts to the operation mode, and executes control (NO in S12).

On the other hand, if the referenced error factor is an abnormality detected by the WDT error detection element 179 (YES in S12), the processor 170 notifies the management device 110 to that effect and stays in the initialization process. Wait for instructions from 110. That is, the processor 170 does not enter the operation mode and does not execute the control process (also referred to as a standby mode).

  Next, the standby mode will be described. In step S13, the processor 170 checks whether there is any instruction from the management apparatus 110. If there is no instruction, the processor 170 repeats the check (NO in S13). On the other hand, when there is any instruction from the management device 110, the processor 170 checks whether the instruction instructs to shift to the operation mode (YES in S13 and S14). In step S14, when the instruction received from the management apparatus 110 is a transition to the operation mode, the processor 170 performs the initialization process for the entire main circuit 154 and then transitions to the operation mode.

  In step S14, when the instruction received from the management apparatus 110 is not an instruction to shift to the operation mode, the processor 170 moves to step S15 (NO in S14) and executes processing according to other instructions. . The other instructions include various instructions. For example, if the management apparatus 110 issues an instruction (restore instruction) to rearrange the data backed up in the third memory, the processor 170 causes the third memory 184 to be relocated. The data backed up in (1) is relocated to the original memory (second memory 182) and restored. In this way, the present invention can return the various data related to the controlled device 130 to the state when it is substantially equal to the time of occurrence of the abnormality, and can resume control after recovery from the state substantially equal to the time of occurrence of the abnormality. .

In addition, when the management device 110 gives an instruction to transmit the data backed up in the third memory 184 to the management device 110 (backup data transmission instruction), the processor 170 transmits the data via the first communication element 172. and it transmits to the batch or managing apparatus part such as designated area 110 (external). By doing so, the present invention can notify the management apparatus of data that is substantially equal to the occurrence of an abnormality, so that the user can efficiently perform analysis work such as the relationship with the abnormality.

Therefore, by providing such a standby mode, it is possible to operate the programmable controller after performing appropriate measures based on the confirmation of the user's abnormality factor.
In short, the access element 178 backs up the data stored in the second memory 182 to the third memory 184 when an abnormality relating to the processor 170 occurs. At this time, the access element 178 records the cause of the abnormality that triggered the backup in the error factor recording area of the third memory 184, and restarts the processor 170. The restarted processor 170 refers to the cause of the abnormality recorded in the error factor recording area prior to shifting to the operation mode (control execution). The processor 170 remains in the standby mode if the referenced abnormality factor is an abnormality related to the processor 170 (an abnormality that hinders the execution of the program of the processor 170).

  Note that the present invention is configured to shift to the operation mode while maintaining various settings of the main circuit 154 without performing the initialization process of the entire main circuit 154 when shifting to the operation mode in step S14 of FIG. You may do it. This is because the processor 170 that has shifted to the standby mode may have directly suffered damage related to the abnormality, so the initialization processing of the entire main circuit 154 (such as performing various settings after clearing the memory) is executed normally. This is because there is no denying the possibility that various settings will be rewritten to unexpected data. On the other hand, if the processor 170 can normally execute the program, the present invention has an advantage that the initialization time can be reduced and the program can be operated quickly.

  Note that in order to maintain the various settings of the main circuit 154 as described above and shift to the operation mode, the processor 170 (only) is reset during the operation mode, not the cold start that is started when the power is turned on. It can be applied during a hot start that restarts. That is, the restart process to the processor 170 of the present invention corresponds.

In order to identify whether it is started by a cold start or a hot start, in the present invention, for example, a register that is cleared by a power-on reset is provided in the access element 178, and the processor 170 refers to the register at the time of startup. , if it is "0" cold start, it can be configured to a hot start if it is "1". By referring to this register, the processor 170 can identify whether it has been started by a cold start or a hot start.
(Backup data transfer process)
The backup data transfer process of the access element 178 will be described. When the access element 178 transfers data from the second memory 182 to the third memory 184, the data is read from the second memory 182, and the data is output to the third memory while the data is output to the common bus 176. Write to 184. That is, the access element 178 can access the second memory 182 and the third memory 184 simultaneously.

  FIG. 4 is a timing chart showing the detailed timing of data transfer. For example, an example in which data B stored at an arbitrary address A in the second memory 182 is transferred to the third memory 184 will be described. Here, the storage capacity of the third memory 184 is set to be equal to or greater than the storage capacity of the second memory 182, and the address spaces (memory maps) of the second memory 182 and the third memory 184 are made equal.

  The access element 178 specifies an arbitrary address A in the second memory 182 and the third memory 184 by outputting the address A to the address line of the common bus 176, and directly controls only the / RD signal of the second memory 182. As a result, the data B of the second memory 182 is read to the data line of the common bus 176. However, other permission signals such as CS (Chip Select) are omitted here.

  While the address A is output to the address line of the common bus 176 and the data B is output to the data line of the common bus 176, the access element 178 directly receives only the / WR signal of the third memory 184. By controlling, the data B output to the data line of the common bus 176 is written in the third memory 184.

  Conventionally, data reading and writing have been performed at different timings. In the present embodiment, since data can be performed at the same timings, data transfer can be speeded up and backup processing can be shortened. be able to. Also, the time required for shortening can be used for other backup processing. Furthermore, since the data transfer load can be reduced, the power consumed for backup processing can be greatly reduced.

  As described above, according to the present invention, it is possible to provide a highly reliable programmable controller that can reliably execute backup processing even when an abnormality occurs in the processor 170.

  Note that each step of the backup coping method of the present specification does not necessarily have to be processed in time series in the order described in the flowchart, and may include parallel or subroutine processing.

  Further, although the present invention has been described with respect to an embodiment in which the watchdog timer overflows as a method for dealing with an abnormality, the present invention is not limited to this. For example, the present invention can be directed to parity errors, program sum check errors, and access of the processor 170 to undefined areas where no memory is allocated. That is, the abnormalities handled in the present invention are all abnormalities that hinder the execution of the program of the processor 170.

In the present invention, the access element 178 may include an arbitration function, the processor 170 and the first communication element 172 may be disconnected from the shared bus 176, and both and the first memory may be connected by a dedicated bus. At this time, the arbitration function arbitrates the access right to the common bus 176 (the second memory 182 and the third memory 18 4 ) to either the processor 170 or the first communication element 172. Processor 170 or the first communication device 172 has gained access would access the second memory 182 and third memory 18 4 via the access device 178.

  The operation mode in the above description refers to a state in which the programmable controller 120 or the programmable controller system 100 executes an application program (sequence program) to control an external device.

  INDUSTRIAL APPLICABILITY The present invention can be used as an information processing apparatus including a storage unit as a programmable controller capable of programming control processing for a controlled device, a data backup method thereof, and a programmable controller activation method.

DESCRIPTION OF SYMBOLS 100 ... Programmable controller system 110 ... Management apparatus 120 ... Programmable controller (PLC)
130 ... controlled device 154 ... main circuit 170 ... processor 172 ... first communication element 176 ... common bus 178 ... access element 179 ... WDT (watchdog timer) error detection unit 180 ... second communication element 182 ... second memory (subject Backup memory)
184 ... Third memory (backup memory)

Claims (8)

A backup storage unit;
A backup storage unit;
A central processing unit and an access element capable of accessing the backup storage unit and the backup storage unit;
An error detection unit that detects an abnormality in the operation of the central processing unit,
When an error in the operation of the central processing unit is detected by the error detection unit, the access element saves the data in the backup storage unit to the backup storage unit, and sets the detected cause of the abnormality A programmable controller, which records in a predetermined area of a backup storage unit.   2. The programmable controller according to claim 1, wherein the access element executes reading of data from the backup storage unit and writing to the backup storage unit in the same access cycle.   3. The programmable controller according to claim 1, wherein the access element stops access to the central processing unit when an error in the operation of the central processing unit is detected by the error detection unit. 4. . The programmable controller according to any one of claims 1 to 3,
The central processing unit refers to a predetermined area of the backup storage unit at the time of startup, and it is recorded in the predetermined area that an abnormality in the operation of the central processing unit has been detected by the error detection unit. A programmable controller characterized by waiting for a predetermined instruction from the outside in a standby mode. A programmable controller according to claim 4, wherein
The predetermined instruction is a restoration instruction;
When receiving the restoration instruction, the central processing unit restores data stored in the backup storage unit to the backup storage unit. A programmable controller according to claim 4, wherein
The predetermined instruction is a backup data transmission instruction,
When the central processing unit receives the backup data transmission instruction, the central processing unit transmits all or a part of the data stored in the backup storage unit to the outside. A data backup method for backing up data stored in the backup storage unit of a programmable controller having a backup storage unit and a backup storage unit to a backup storage unit,
When an abnormality of the central processing unit mounted on the programmable controller is detected, an access element different from the central processing unit saves the data in the backup storage unit to the backup storage unit, and the detected abnormality A data backup method for a programmable controller, wherein the factor is recorded in a predetermined area of the backup storage unit. A method for starting a programmable controller that backs up data stored in a backup storage unit in response to a predetermined abnormality to a backup storage unit and records the cause of the predetermined abnormality in a predetermined area of the backup storage unit,
The programmable controller refers to the predetermined cause of abnormality prior to control execution after startup, and remains in a standby mode when the referenced abnormality factor is an abnormality related to the central processing unit of the programmable controller. A programmable controller activation method.