JP6401657B2 - Process control system, maintenance support device and controller - Google Patents

Description

  The present invention relates to a process control system that controls a plant apparatus, and a maintenance support apparatus and a controller included in the process control system.

In power plants and factories, the suspension of operation of various plants immediately leads to a decrease in product production, which in turn leads to a decline in sales and profits. Therefore, it is desired to be able to operate the plant without stopping the operation as much as possible.
In order not to cause an abnormality that stops the system, it is important to appropriately manage a control program that performs process control. For this reason, it is possible to reliably detect revisions of the control program that affect the operation, and to confirm that the revision scope is necessary and sufficient, and to cross-check whether the revisions are correct. It is important to be able to do that. By enabling the system operator to manage revisions of the control program in this way, erroneous control program updates can be prevented and the system operating rate can be increased.

  In order to manage revision of the control program described above, conventionally, an ID is assigned to each control program and revision management is performed. For example, in the version check method disclosed in Patent Document 1, date information on the generation date is used as the ID of the management target.

JP-A-2005-242492

  In a process control system that controls a plant apparatus, when a large-scale control program revision is performed, it is inevitable that the update work procedure becomes complicated. At this time, there is a possibility that a target error of the update program or an update failure may occur, and since there is a wide range of functions that may be affected, an operation check failure of the control program is likely to occur. When such an operation check omission of the control program occurs, there is a possibility that the operation may be continued with a defect.

  In addition, when the program revision becomes large, the program revision work may be shared by a plurality of devices. At this time, in version management based on date information as described in Patent Document 1, the order of revision order may be disrupted due to a time setting shift or time difference for each apparatus, and the latest program is erroneously determined. there is a possibility. In addition, even when IDs are assigned with hash values, etc., only updates as program files can be detected, so it is impossible to grasp how much the revision of the program will affect the operation of the system, and an appropriate work plan I ca n’t stand up.

  An object of the present invention is to make it possible to easily and reliably check update contents and perform authentication processing when a control program is revised.

The process control system of the present invention holds a control program to which an individual identification code that can be determined as a numerical value for each component is held, and executes a held control program to control a process to be controlled, and a control A process control system including a maintenance support device that revises a program and sets the revised control program in a controller.
The maintenance support device executes the revision work of the control program, and when the revision work is performed, the maintenance support apparatus has already been used for the revised component and the components that are higher than the revised component. The control program revision unit that assigns a new identification code whose value is greater than the identification code and the maximum value among the identification codes assigned to the components of the control program revised by the control program revision unit are revised. And a control program distribution unit that distributes the control program to the controller.

A maintenance support apparatus according to the present invention revises a control program to which individual identification codes that can be determined as numerical values for each component are revised, and distributes the revised control program to a controller that controls a process to be controlled. It is.
Then, the control program revision work is executed, and when the revision work is performed, the revised component and the component affected by the revised component are identified based on the identification codes already used. A control program revision unit that assigns a new identification code whose value also increases,
A control program distribution unit that distributes the maximum value among the identification codes assigned to the components of the control program revised by the control program revision unit to the controller as the identification code of the revised control program; .

The controller of the present invention controls a process to be controlled by a control program storage unit that stores a control program to which individual identification codes that can be determined as numerical values for each constituent element are stored, and a control program stored in the control program storage unit When the control processing unit and the control program stored in the control program storage unit are updated, the difference between the identification code of the control program before the update and the identification code of the control program after the update is within a preset threshold. In some cases, the system includes an execution program management unit that permits updating of the control program and restricts execution of the updated control program when a threshold value is exceeded.

  According to the present invention, the control program can be updated accurately without error. In addition, it is possible to eliminate an operator's judgment error when performing update work, and to prevent an error in the work plan. Therefore, according to the present invention, it is possible to eliminate a problem at the time of updating the control program, and thus it is possible to realize a system operation with a high operation rate.

It is a block diagram which shows the example of a structure of the whole system by the example of 1 embodiment of this invention. It is a flowchart which shows the example of the program revision procedure by one embodiment of this invention. It is a flowchart which shows the example of the process which provides ID to the component and program by one embodiment of this invention. It is a figure which shows the example of an internal structure of the control program by the example of 1 embodiment of this invention, and the example (Example 1) of provision of ID. It is a figure which shows the example of an internal structure of the control program by the example of 1 embodiment of this invention, and the example of giving ID (example 2). It is a figure which shows the example of an internal structure of the control program by the example of 1 embodiment of this invention, and the example of giving ID (example 3). It is a figure which shows the internal structural example of the control program by the example of 1 embodiment of this invention, and the example (Example 4) of provision of ID. It is a flowchart which shows the process example by the maintenance assistance apparatus by one embodiment of this invention. It is a flowchart (continuation of FIG. 8) which shows the process example by the maintenance assistance apparatus by one embodiment of this invention.

Hereinafter, an embodiment of the present invention (hereinafter referred to as “this example”) will be described with reference to the accompanying drawings.
[1. Overall system configuration]
FIG. 1 shows an example of the overall configuration of the process control system 100.
The process control system 100 is a control system including duplicated controllers 1a and 1b. That is, the process control system 100 includes two controllers 1a and 1b that control the control target process 3 via the process input / output device 2 and a maintenance support device connected to the two controllers 1a and 1b via the communication network 4. 5. One controller 1a of the two controllers 1a and 1b is referred to as an A system, and the other controller 1b is referred to as a B system. Here, the A-system controller 1a is the main system, and the B-system controller 1b is the standby system. However, as will be described later, the main system and the standby system are switched depending on the control status.

The A-system controller 1a includes a controller storage unit 10a and a controller processing unit 11a. The information stored in the controller storage unit 10a includes an approval ID table 12a. The controller processing unit 11a includes an execution program management unit 13a, a state control unit 14a, and a control processing unit 15a. An execution control program 16a is stored in the control processor 15a. The execution control program 16a is stored in a control program storage unit (not shown) in the control processing unit 15a. When the controller 1a is the main system, the control processing unit 15a controls the process 3 to be controlled through the process input / output device 2 by executing the execution control program 16a.
The B system controller 1b has the same configuration as the A system controller 1a. That is, the B-system controller 1b includes a controller storage unit 10b and a controller processing unit 11b. The information stored in the controller storage unit 10b includes an approval ID table 12b. The controller processing unit 11b includes an execution program management unit 13b, a state control unit 14b, and a control processing unit 15b. The control processing unit 15b stores an execution control program 16b. The execution control program 16b is stored in a control program storage unit (not shown) in the control processing unit 15b. When the controller 1b becomes the main system instead of the controller 1a, the control processing unit 15b controls the control target process 3 via the process input / output device 2 by executing the execution control program 16b.

  The control processing units 15a and 15b are configured by, for example, an arithmetic processing device using a general-purpose microprocessor or FPGA (Field-Programmable Gate Array) and a storage device using a semiconductor memory. The execution control programs 16a and 16b are information stored in the storage devices of the control processing units 15a and 15b. The arithmetic processing unit realizes a predetermined control operation by executing the execution control programs 16a and 16b. In addition, the IDs of the approved control data are stored in the approval ID tables 12a and 12b.

The state control units 14a and 14b receive the controller state transition request transmitted from the maintenance support device 5 for updating and maintenance of the control programs 16a and 16b. Then, according to the received contents, the state control units 14a and 14b manage the stop and operation of the controllers 1a and 1b.
The execution program management units 13a and 13b check whether or not the control programs 16a and 16b to be executed are executable when the controllers 1a and 1b are shifted to the operation state by the state control units 14a and 14b.
Specifically, the execution program management units 13a and 13b first check whether or not the execution control programs 16a and 16b have been approved with reference to the approval ID tables 12a and 12b. Next, the execution program management units 13a and 13b check whether or not the control programs 16a and 16b to be executed are different from the functions of the control program of the other system. As a result of the check, if the execution program management units 13a and 13b determine that the execution control program 16 is not executable, the execution program management units 13a and 13b return the fact to the state control units 14a and 14b and interrupt the state transition process.

  The control processing units 15a and 15b input process data from the control target process 3 via the process input / output device 2 according to instructions of the control programs 16a and 16b, and calculate control data. Then, the control processing units 15 a and 15 b output a part of the calculated control data to the control target process 3 via the process input / output device 2.

The maintenance support device 5 includes a maintenance function processing unit 50 and a maintenance data storage unit 51. The maintenance function processing unit 50 includes a control program editor unit 52, a control program compiler unit 53, a control program distribution unit 54, a control program comparison unit 55, and a control program approval unit 56. The control program editor unit 52 and the control program compiler unit 53 function as a control program revision unit that revises the control program.
The data stored in the maintenance data storage unit 51 includes a control program source 57, assignment ID data 58, and a distribution control program 59.
The maintenance support device 5 is configured by a computer device including an arithmetic processing device and a semiconductor memory, and is connected to an input device 60 such as a keyboard and a mouse and a display device 61 such as a liquid crystal display (LCD). ing.

The control program editor unit 52 has a graphical user interface for the display device 61 and the like, accepts user operation input via the input device 60, and creates a new control program source 57 or the existing control program source 57. Make revisions. The revision here includes various processes for changing a part of the control program source 57, such as addition of a constituent element of the control program source 57, in addition to a modification of rewriting a part of the control program source 57. included.
When the revised contents of the control program source 57 affect the operation of the program, the control program editor unit 52 newly assigns IDs to the revised components and affected parts of the control program source 57. This ID is recorded in the assignment ID data 58, and each time the ID is given, the control program editor unit 52 updates the value with the addition ID data 58 added to the original value. For example, it is updated to a value obtained by adding one to the original value. Since the ID recorded in the assigned ID data 58 is assigned for each component of the control program, one control program has a plurality of IDs. An example of ID assignment will be described later.

The control program compiler unit 53 performs a compiling process for converting the control program source 57 into a program that can be executed by the computer apparatus, and creates a distribution control program 59 that is an execution program module in the controllers 1a and 1b. At this time, the ID written in the source is assigned to the distribution control program 59.
The control program source 57 and the distribution control program 59 created in this way are temporarily stored in the maintenance data storage unit 51 of the maintenance support device 5. Then, the distribution control program 59 is distributed by the control program distribution unit 54 to the B-system controller 1b which is a standby system, and the execution control program 16b is revised.

Further, an operator who approves when the control program source 57 is revised compares the distribution control program 59 to be updated with the execution control program 16b that is already operated by the control program comparison unit 55. , Compare whether the update is correct. In this comparison, when the approval worker determines that the update content is valid, the control program approval unit 56 sets the approval ID in the approval ID table 12b that manages the approval ID for each component of the control program.
Further, after the revised execution control program 16b is approved and the operation is confirmed by the operator, the main system is switched from the A system controller 1a to the B system controller 1b. The controlled process 3 is controlled by the B system controller 1b in which the revised execution control program 16b is set. Thereafter, the distribution control program 59 is distributed to the A-system controller 1a that has become the standby system, and the execution control program 16a is also revised.

[2. Flow of processing when control program is revised]
FIG. 2 is a flowchart showing a procedure for a user to revise a program on the maintenance support device 5 and a flow of processing executed thereby.
First, the revision operator revises the control program using the maintenance support device 5, and stores the revised control program (step S11). At this time, the control program editor unit 52 assigns and outputs the revised control program source 57 with the ID 571 managed by the assignment ID data 58. A plurality of control program sources 57 can be output, and each is assigned an ID. For example, as shown in FIG. 2, when revised control program sources 57-1, 57-2, and 57-3 exist, IDs 571-1, 571-2, and 571-3 are assigned to them.

  Next, when the revision operator performs a compile operation (step S12), the control program compiler unit 53 outputs a distribution control program 59 based on the control program source 57. At this time, the distribution control program 59 is assigned the same ID 591 as the ID 571. A plurality of distribution control programs 59 can be output, and each is assigned an ID. For example, as shown in FIG. 2, when the revised distribution control programs 59-1, 59-2, 59-3 exist, IDs 591-1, 591-2, 591-3 are respectively assigned.

  Next, when the revision operator performs a download operation (step S13), the control program distribution unit 54 distributes the distribution control program 59 to the standby system controller (A system controller 1a or B system controller 1b). The distributed distribution control program 59 is overwritten and copied to the execution control program 16a or 16b of the control processing unit 15a or 15b. At this time, the ID 161a or 161b of the execution control program 16a or 16b that has been overwritten is also overwritten with the same ID 591 of the distribution control program 59. For example, as shown in FIG. 2, when the revised execution control programs 16-1, 16-2, 16-3 exist, the respective IDs 161-1, 161-2, 161-3 are also rewritten.

  Thereafter, the worker who performs the approval performs a comparison check between the distribution control program 59 and the execution control program 16a or 16b before the revision on the maintenance support device 5 (step S14). At this time, the control program comparison unit 55 causes the display device 61 to display revised components of the distribution control program 59. When the worker who performs the approval performs an approval operation for the revised control program (step S15), the control program approval unit 56 sets the approval ID 161 as the ID value of the control program to be approved. That is, the control program approval unit 56 matches the value of the corresponding ID on the approval ID table 12a or 12b with the ID of the execution control program 16a or 16b.

  Finally, the worker executes the control processing unit 15a or 15b on the controller 1a or 1b, operates the execution control program 16a or 16b set in the control processing unit 15a or 15b, and displays the execution result as a maintenance support device. 5 is output. The operator confirms the output contents.

[3. ID assignment process when the control program is revised]
The flowchart of FIG. 3 shows an example of ID assignment processing when the control program is revised.
The control program editor unit 52 compares the revised control program source 57 with the control program source 57 before revision, and determines an updated component (step S101). The updated components here include components indicating functions in addition to components indicating processing.

  Furthermore, when the component determined in step S101 is changed, it is determined whether there is another component that affects the processing content (step S102). Here, if there is another component that affects the processing content (Yes in step S102), the updated component and the ID assigned to the component that affects are deleted (step S103). When there is no other component that affects the processing content (No in step S102), the ID assigned to the updated component is deleted (step S104).

  Next, the control program editor unit 52 newly assigns an ID to the component from which the ID has been deleted (step S105). At this time, the control program editor unit 52 sequentially assigns each component with an ID obtained by adding one value from the largest value of the IDs already assigned as the assigned ID data 58. However, adding one value is one example, and a value exceeding 1 may be added as will be described later.

  When the ID assigning process in step S105 is completed, the control program editor 52 sets the largest value among the IDs assigned to the respective components in step S105 as the revised ID of the control program source 57 ( Step S106). When the ID of the control program source 57 is set in step S106, the ID 571 of the control program source 57 stored in the maintenance data storage unit 51 is updated to the set value. By updating the ID 571, the ID 591 of the distribution control program 59 and the IDs 161a and 161b of the execution control programs 16a and 16b are also updated when the revised control program is distributed.

  Note that the control program approval unit 56 of the maintenance support device 5 determines the component that has been revised based on the match or mismatch of the IDs of the respective components before and after the revision of the control program. Based on the determination, the control program approval unit 56 notifies the controllers 1a and 1b of whether or not the component has been revised.

[4. Example of ID assignment processing (Example 1)]
FIG. 4 shows an example (Example 1) of an ID assignment process when some components of the control program are revised.
Here, the control program A for eight components is shown in a tree structure. In the initial state C11 before revision, individual IDs are assigned to the respective components. That is, task-L and task-M exist under the highest element CPU-A, and process-P exists under task-L. Further, a function -V and a function -W exist below the process -P. Further, a function -X exists below the process -Q. At this time, as shown in FIG. 4, IDs “1” to “8” are individually assigned to the eight components of the program in the state C11. The value in parentheses in FIG. 4 is the ID.
In the initial state C11, “8” which is the maximum value of the component ID is the ID of the control program A.

Then, it is assumed that the process-Q is changed to the revised state C12 by the revision of the control program by the operator from the initial state C11. At this time, the control program editor unit 52 deletes the ID (6) of process-Q. FIG. 4 shows a state in which the ID is deleted with the ID value in parentheses blank.
In addition, the IDs of the other components that may affect the processing contents when the processing-Q is revised are also deleted. Here, IDs are also deleted for the task-M, which is a higher-order component than the process-Q, and for the CPU-A, which is a higher-order component of the task-M.

And in state C13 at the time of preservation | save of the revised control program, new ID is provided to process-Q, task-M, and CPU-A. At this time, the maximum value of the ID of the component before revision is “8”, and the next assigned ID is “9” which is a value obtained by adding one to “8”. In this example, since the lowest order of the elements to which no ID is assigned is process-Q, the process-Q ID is set to “9”. Subsequently, the values are added one by one in order from the lower element, and “10” is assigned to task-M and “11” is assigned to CPU-A.
The ID of the revised control program A is “11” because it is the maximum value of the IDs of these elements.

[5. Example of ID assignment processing (example 2)]
FIG. 5 shows an example (example 2) of an ID assigning process when some components of the control program are revised. The control program A in the initial state C11 in the example of FIG. 5 is the same as the control program A in the initial state C11 in the example of FIG.
In the initial state C11, “8” which is the maximum value of the component ID is the ID of the control program A.

  Then, it is assumed that the task-M is changed to the revised state C14 by the revision of the control program by the operator from the initial state C11. At this time, the control program editor unit 52 deletes the ID (7) of task-M. In addition, the IDs of other component elements that may affect the processing contents when the task-M is revised are also deleted. Here, the ID of CPU-A, which is a higher-order component of task-M, is deleted. If the ID value in the parentheses is blank, the ID is deleted.

In the state C15 when the revised control program is saved, new IDs are assigned to the task-M and the CPU-A. At this time, the maximum value of the component ID before revision is “8”, the task-M is “9”, and the CPU-A is “10”.
The revised ID of the control program A is “10” because it is the maximum value of the IDs of these elements.

[6. Example of ID assignment processing (example 3)]
FIG. 6 shows an example (example 3) of ID assignment processing when some components of the control program are revised. The control program A in the initial state C11 in the example of FIG. 6 is the same as the control program A in the initial state C11 in the example of FIG.
In the initial state C11, “8” which is the maximum value of the component ID is the ID of the control program A.

Then, it is assumed that the function -X is changed to the revised state C16 by the revision of the control program by the operator from the initial state C11. At this time, the control program editor unit 52 deletes the ID (3) of the function -X.
In addition, the IDs of other components that may affect the processing contents when the function-X is revised are also deleted. Here, the IDs of process-Q, task-M, and CPU-A, which are upper components of task-M, are deleted. If the ID value in the parentheses is blank, the ID is deleted.

In the state C17 when the revised control program is saved, new IDs are assigned to the function -X, the process -Q, the task -M, and the CPU-A. At this time, the maximum value of the ID of the component before revision is “8”, the function −X is “9”, the process −Q is “10”, the task −M is “11”, and the CPU-A Is "12".
The ID of the revised control program A is “12” because it is the maximum value of the IDs of these elements.

[7. Example of ID assignment processing (example 4)]
FIG. 7 shows an example (example 3) of ID assignment processing when some components of the control program are revised. The control program A in the initial state C11 in the example of FIG. 7 is the same as the control program A in the initial state C11 in the example of FIG.
In the initial state C11, “8” which is the maximum value of the component ID is the ID of the control program A.
Then, it is assumed that the initial state C11 is changed to the state C18 in which the process-Q is revised by the revision of the control program by the operator. At this time, the control program editor unit 52 deletes the ID (6) of process-Q.
Here, it is assumed that the revision of the process-Q does not affect other components. Alternatively, in managing IDs, it is assumed that the revision of the process-Q can ignore the influence on the task-M and CPU-A, which are upper components. In this case, the task-M or CPU-A ID is not deleted as in the state C18 shown in FIG.

And in state C19 at the time of preservation | save of the revised control program, new ID is provided to process-Q. At this time, the maximum value of the ID of the component before revision is “8”, and the ID assigned next is “9” which is a value obtained by adding one to “8”. The revised ID of the control program A is “9” because it is the maximum value of the assigned ID.
It should be noted that the ID assignment state of each component shown in FIGS. 4 to 7 is one example, and other ID assignment states may be used as will be described in a later-described modification.

[8. Example of control program update on the controller]
FIGS. 8 and 9 are flowcharts showing the switching process in the controllers 1a and 1b when the execution control programs 16a and 16b are updated.
The left side of FIGS. 8 and 9 shows processing in the maintenance support device 5, and the right side of FIGS. 8 and 9 shows the states of the controllers 1a and 1b. As shown in FIG. 8, in the initial state C21, the A-system controller 1a is the main system and the B-system controller 1b is the standby system. Here, the online operation state is a state in which control data is output to the process 3 to be controlled in the case of the main system, and in the case of the standby system, the same control program as that of the main system is executed to the main system at any time. This is a state in which switching is possible.

First, the maintenance support device 5 transmits a stop request to the standby B-system controller 1b in the state C21 (step S21). When the state control unit 14b of the B-system controller 1b receives the stop request, the state controller 14b puts its own device into a stop state (state C22). The stop state here means a state in which the execution of the control program 16b is stopped. Therefore, in the state C22, the B-system controller 1b is in a state where so-called hot standby is released.
In this state, the maintenance support device 5 transmits the revised control program 59 to the standby B-system controller 1b in the state C22 (step S22). The B-system controller 1b receives the control program 59, and updates the control program 16b to the revised control program 59.

  Next, the maintenance support device 5 transmits an offline operation request to the standby B-system controller 1b (step S23). When the state control unit 14b of the B-system controller 1b receives the offline operation request, the state controller 14b sets the own apparatus in the standby system offline operation state (state C23). Here, the offline operation state is a state in which the standby B-system controller 1b starts executing the control program 16b and confirms whether the operation is correct. Whether the operation is correct or not can be determined, for example, by comparing the matching control data transmitted from the A-system controller 1a by the B-system controller 1b with the control data obtained by the own apparatus.

Here, when the standby B-system controller 1b is in an offline operation state, immediately before the execution of the control program 16b is started, a process for checking whether the control program intended by the operator is operating on the controller 1b is performed. Is called. That is, the execution program management unit 13b of the B-system controller 1b determines the approval state of the control program 16b.
First, the execution program management unit 13b determines whether or not the control program 16b has been approved (step S24). Here, the execution program management unit 13b determines whether or not an ID is registered in the approval ID table 12, and determines whether the ID has been approved or not.
Here, if the ID is not registered in the approval ID table 12b, it is in an unapproved state (No in step S24), and the execution program management unit 13b interrupts the process, and the display device 61 or the like indicates that the ID is not approved. Notify workers. Then, after the operator takes measures such as further revising the control program 59, the processing from step S21 is executed again. If the ID is registered in the approval ID table 12, it is approved (Yes in step S24), and the execution program management unit 13b continues the process, and proceeds to the determination in step S25.

Next, the execution program management unit 13b copies the approval ID data recorded in the approval ID table 12a of the A system controller 1a onto the controller storage unit 10b of the B system controller 1b. Then, the execution program management unit 13b compares the copied approval ID data value with the ID value of the standby approval ID table 12b, and determines the difference between the two ID values (step S25).
In step S25, the ID difference is determined by, for example, comparing the ID “8” of the control program A in the state C11 before update shown in FIG. 4 with the ID “11” of the control program A in the state 13 after update. It corresponds to that. Determining the difference between the ID values determines whether or not the revision scale of the control program exceeds a prescribed value (a prescribed scale).

  The specified value of the ID difference here is preset according to the characteristics of the system. If the revision scale exceeds this specified value, it is expected that the update during online operation will be affected greatly by the program revision and sufficient operation cannot be confirmed. Make a decision. Specifically, for example, the specified value is set to a relatively small value such as “1” or “2”.

  If it is determined in step S25 that the specified value has been exceeded (No in step S25), the maintenance support device 5 interrupts online maintenance and notifies the operator that the scale of modification is large and online maintenance cannot be performed using the display device 61 or the like. To do. The worker who confirms the notification performs simulation in another inspection environment, confirms the operation, and performs the update operation. If it is determined in step S25 that the revision scale is within the specified value (Yes in step S25), the process is continued.

  Next, the worker confirms the operation of the control program 16b and determines whether or not the operation of the B-system controller 1b is correct (step S26). Here, when it cannot be confirmed that the operation of the B-system controller 1b is correct (No in step S26), the process is interrupted. Then, the operator takes measures such as further revising the control program 59, and executes the processing in step S21 and subsequent steps again.

When it is confirmed in step S26 that the operation of the B system controller 1b is correct (Yes in step S26), the maintenance support device 5 transmits an online operation request to the standby system B controller 1b (step S27). . When receiving the online operation request, the state control unit 14b of the B-system controller 1b sets its own device in the standby system online operation state (state C24).
Next, the maintenance support device 5 transmits a main system abandonment request to the main system A controller 1a (step S28). The A system controller 1a that has received the main system abandonment request abandons the main system and enters the standby system online operation state, and accordingly, the B system controller 1b enters the main system online operation state (state C25). In the state C25, the main system and the standby system of the A system controller 1a and the B system controller 1b are changed.

Thereafter, the process proceeds from the process of FIG. 8 to the process of FIG. 9, and the process of step S31 is performed.
The processing in steps S31 to S38 in FIG. 9 is processing performed by the maintenance support device 5 for the A-system controller 1a. In steps S21 to S28 in FIG. 8, the maintenance support device 5 performs processing for the B-system controller 1b. The content is the same as the processing. That is, steps S31 to S38 are obtained by replacing the A-system controller 1a and the B-system controller 1b in the processing of steps S21 to S28, and the description thereof is omitted here. Regarding the controller states, states C31 to C34 are states in which the A system controller 1a and the B system controller 1b are switched from the states C22 to C25.

As described above, the control programs 16a and 16b of the A system controller 1a and the B system controller 1b are updated to the revised control program 59 transmitted from the maintenance support device 5. Then, the states of the A-system controller 1a and the B-system controller 1b return to the original state C21.
As described above, according to the process control system 100 in which the controllers 1a and 1b of this example are duplicated, the two controllers 1a and 1b sequentially become standby systems, and the standby system controllers are set in an offline state to update the control program. Will be done. When the control program is updated, it is determined for each of the controllers 1a and 1b whether the remodeling scale of the control program is within an allowable range. If the control program is within the allowable range, the update is permitted. Therefore, according to the process control system 100 of this example, online maintenance when the influence of updating is large and the risk is high is restricted, and safe system operation can be realized.

[9. Specific example when updating control program]
Here, the specific process of determining the revision scale of the control program by comparing the value of the control program ID before the update and the value of the control program ID after the update performed in steps S25 and S35, This will be described with reference to the examples of FIGS.
For example, it is assumed that the specified value for comparison is “1”. At this time, as shown in FIG. 4, when the ID of the control program A before the update is “8” and the ID of the control program after the update is “11”, the difference between both ID values is “3”. "become. Therefore, in the example of FIG. 4, the execution program management unit 13b determines that the specified value exceeds “1”, and detects that the scale of the program modification exceeds the allowable range. For this reason, in the maintenance support apparatus 5, online maintenance is interrupted on the assumption that detailed operation confirmation is required. In the example of FIG. 5 and the example of FIG. 6, the difference between the ID values before and after the update is “2” and “4”, respectively. Similarly, the scale of the program modification exceeds the allowable range. Is detected. On the other hand, in the example of FIG. 7, the difference between the ID values before and after the update is “1”, and it is detected that the remodeling scale of the program is within the allowable range.

Thus, when the specified value is “1”, only one component of the control program is modified, and only when the modification is a small one that does not affect the other components. On-line maintenance will automatically allow revision of the control program.
If the specified value is set to “2”, the revision of the control program shown in FIG. 5 falls within the allowable range, and the example of FIG. 4 and the example of FIG. 6 fall outside the allowable range. The value to be set as the predetermined value depends on various requirements such as the configuration of the control target process 3 and the degree of stability of the system required.

[10. Modified example when setting ID]
In the embodiment described above, when the control program is revised, the maintenance support device 5 performs a process of setting a value obtained by adding one to the used ID value for each modified component as a new ID. I did it. For example, in the example of FIG. 6, in the state C17, the function-X that is the updated component and the processing-Q, task-M, and CPU-A that are the affected components are assigned the ID of the original control program. “9”, “10”, “11”, and “12” larger than “8” are set.

  On the other hand, the maintenance support device 5 may weight each component element to which an ID is reassigned according to the importance of the component element, and may variably set an addition value at the time of ID assignment. For example, the component of the function is a value obtained by adding three from the ID assigned immediately before because the influence of the correction is large. The processing component is moderately affected by the correction, and is a value obtained by adding two from the ID assigned immediately before. Further, since the task and the CPU component are relatively less affected by the correction, a value obtained by adding one from the ID assigned immediately before is assumed. When the ID of each component is set in the state C17 in the example of FIG. 6 with such a rule, the function -X (11), processing -Q (13), task -M (14), CPU- A (15). The ID of the control program A after correction is “15”.

  Since weighting is performed when assigning IDs to the components in this way, the difference between before and after the modification of the ID of the control program becomes more prominent depending on the scale of modification. Therefore, it is possible to more accurately determine whether the revision is safe by comparing the difference between the control program ID before and after the correction and the specified value.

  Further, instead of weighting each type of component, weighting may be performed when an ID is automatically reassigned based on the modification pattern of the modified component and the degree of modification. For example, even if there is only one modified component, if two locations in the component are modified, the value obtained by adding two from the ID assigned immediately before is used. Even in this way, the difference between before and after the correction of the ID of the control program becomes more prominent depending on the scale of modification.

  In the examples of FIGS. 4 to 6, IDs are assigned to all the components. On the other hand, ID assignment may be omitted for some components such as the highest-level component (CPU-A in the example of FIG. 4).

[11. Other variations]
Note that the process control system 100 shown in FIG. 1 is configured to include dual controllers 1a and 1b. In contrast, the present invention can also be applied to a system that is not duplicated. However, in the case of a system that is not duplicated, it is necessary to stop the process control and set a revised control program in the controller, and continuous operation as described in the flowcharts of FIGS. 8 and 9 is not possible. .

  Also, in the flowcharts of FIGS. 8 and 9, the approval process in the controller is performed in the order of steps S24, S25, S26 and S34, S35, S36. On the other hand, the order of determining whether or not the approval has been made in steps S24 and S34, the determination of the modification scale in steps S25 and S35, and the determination of the operation in steps S26 and S36 are different. You may make it carry out in order.

  In the embodiment described above, the IDs of the control programs before and after the revision are compared in the controllers 1a and 1b. On the other hand, the IDs of the control programs before and after the revision may be compared in the maintenance support device 5. For example, the control program approval unit 56 in the maintenance support device 5 may perform approval processes such as steps S24, S25, and S26 in FIG.

Furthermore, the present invention is not limited to the above-described embodiments, and various other application examples and modifications can be taken without departing from the gist of the present invention described in the claims.
For example, in the above-described embodiment, the configuration of the apparatus is described in detail and specifically for easy understanding of the present invention, and is not necessarily limited to the configuration including all the configurations described. .
Further, the signal flow lines shown in FIG. 1 showing the internal configuration of the apparatus show what is considered necessary for the description, and do not necessarily indicate all lines necessary for the apparatus. Actually, it may be considered that almost all the components are connected to each other.

DESCRIPTION OF SYMBOLS 1a ... A system controller, 1b ... B system controller, 2 ... Process input / output device, 3 ... Process to be controlled, 4 ... Communication network, 5 ... Maintenance support device, 10a, 10b ... Controller memory | storage part, 11a, 11b ... Controller processing , 12a, 12b ... approval ID table, 13a, 13b ... execution program management unit, 14a, 14b ... state control unit, 15a, 15b ... control processing unit, 16a, 16b ... execution control program, 50 ... maintenance function processing unit 51 ... Maintenance data storage unit 52 ... Control program editor unit 53 ... Control program compilation unit 54 ... Control program distribution unit 55 ... Control program comparison unit 56 ... Control program approval unit 57 ... Control program source 58 ... Assigned ID data, 59 ... distribution control program, 60 ... input device, 61 ... table Display device, 100 ... duplex process control system

Claims (8)

A controller that controls a process to be controlled by holding a control program to which an individual identification code that can be determined as a numerical value for each component is held, and executing the held control program;
A process control system comprising a maintenance support device that revises the control program and sets the revised control program in the controller,
The maintenance support device includes:
Performing the revision work of the control program, and the identifications already used for the revised component and the higher-level components that the revised component will affect when the revision work is performed A control program revision unit for assigning a new identification code whose value increases from the code;
A control program distribution unit that distributes the maximum value among the identification codes assigned to the components of the control program revised by the control program revision unit to the controller as the identification code of the revised control program; Process control system. The control program revision unit uses an identification code whose value monotonously increases by a predetermined value when a new identification code is given to the revised component and the component affected by the revised component,
The process control system according to claim 1, wherein the difference between the identification code of the control program given by the control program distribution unit and the identification code of the control program before revision indicates the revision scale of the revised control program. . The maintenance support device includes a control program approval unit,
The approval unit determines a component that has been revised due to a match or mismatch of identification codes of the respective components, and notifies the controller of whether or not the component has been revised based on the determination. Process control system. The controller controls the revised control program based on the revision scale determined from the difference between the identification code of the revised control program distributed from the control program distribution unit and the identification code of the control program before the revision. The process control system according to claim 1, wherein execution is managed. The controller includes a main controller that controls the process to be controlled, and a standby controller that controls the process to be controlled instead of the main controller when an abnormality occurs in the main controller.
While the main system controller is controlling the process to be controlled, the maintenance support device performs online maintenance to update the control program of the standby system controller to a revised control program, and
When the standby controller performs the online maintenance, the difference between the identification code of the control program being executed by the main controller and the identification code of the updated control program is within a preset threshold. The process control system according to claim 1, wherein the online maintenance is permitted, and the online maintenance is restricted so that the online maintenance cannot be performed when the threshold value is exceeded. When the control program revision unit assigns a new identification code whose value is greater than the identification code already used to the revised component and the component affected by the revised component. The process control system according to any one of claims 1 to 5, wherein an increase value when the value of the identification code is increased is variably set according to the type of component or the degree of modification. A maintenance support device that revises a control program to which an individual identification code that can be determined as a numerical value for each component is given, and distributes the revised control program to a controller that controls a process to be controlled.
The control program is revised, and when the revision work is performed, the revised component and the component affected by the revised component are more than the identification codes already used. A control program revision unit for assigning a new identification code whose value increases;
A control program distribution unit that distributes the maximum value among the identification codes assigned to the components of the control program revised by the control program revision unit to the controller as the identification code of the revised control program; Maintenance support device. A control program storage unit for storing a control program provided with an individual identification code that can be determined as a numerical value for each component;
A control processing unit that controls a process to be controlled by a control program stored in the control program storage unit;
When the control program stored in the control program storage unit is updated, the difference between the identification code of the control program before the update and the identification code of the control program after the update is within a preset threshold, A controller comprising: an execution program management unit that permits updating of the control program and restricts execution of the updated control program when the threshold is exceeded.

Images