JPH02157945A - Digital controller for controlling synchronous duplex power - Google Patents

Abstract

PURPOSE:To complete recovery operation without fail by providing function to establish duplex synchronization in an input / output interface module and providing function to confirm the duplex synchronization in a central arithmetic unit. CONSTITUTION:One side system is defined as A and samely, the other side system is defined as B. When the systems are operated by duplexing, an input / output interface module B breaks down and it is recovered after moving to singling, at first, the transmission and reception of a synchronous parameter is executed between the input / output interface modules A and B. A rising request is outputted to a central arithmetic unit B to inform the recovery. After that, the transmission of all data is executed between central arithmetic units A and B and the input / output interface module is returned to the duplexing. Thus, even when a trouble internally exists in the input / output interface module, system bus or central arithmetic unit, since it is not necessary to execute unnecessary data communication for the synchronous establishment for the central arithmetic unit, external disturbance is not applied to the sound system.

Description

DETAILED DESCRIPTION OF THE INVENTION [Object of the Invention] (Field of Industrial Application) The present invention relates to a multiplexing technique for a digital controller for power control, which particularly requires high reliability.

(Prior art) Control devices used in power control systems such as large, complex power generation plants that are highly public are required to have high reliability. It is used as one means.

There are several methods of multiplexing control devices. Here 1
System failure does not lead to system failure, and of course when operating in a multiplexed configuration, when an abnormality is detected in one of the multiplexed systems,
and a device that prevents erroneous output to the plant during restoration (
For example, consider a case where a sequence controller (sequence controller) is configured in duplicate.

FIG. 2 shows the configuration of a conventional single-layer control device. An input/output module 4 that exchanges control information within the plant (for example, sensor input, actuator output), and a central processing unit 1 that uses a CPU to execute calculations consistent with equipment control based on the input information and calculates output information. are the basic elements. In order to have flexibility in the input/output points processed by each device, they are usually made into building blocks, making it possible to some extent to increase or decrease the predetermined number of input/output modules. Therefore, the input/output module 4 and the input/output interface module 3 constitute the input/output unit 2, and these are connected by the input/output bus b.
The input/output module 4 is placed under the control of the input/output interface module 3. Further, the plurality of input/output units 2 are connected to the central processing unit 1 via a system bus a, and input/output data is exchanged.

At this time, the input/output interface module 3.

It also has an interface function for system bus a. The central processing unit 1 has a microprocessor as its core, and is composed of a memory, a system bus interface, a self-diagnosis circuit, and the like. Further, the input/output interface module 3 is also equipped with a microprocessor.

Considering that duplication is applied to this basic configuration under the conditions described above, the scope of duplication is central processing unit 1, system bus a, and input/output interface module, in order to prevent the system from going down due to a single malfunction. Up to 3 are required.

If a malfunction occurs in the central processing unit 1, the central function as a control device will be lost, and calculations, input/output control, etc. via the system bus a will become impossible.

If a malfunction occurs in the input/output interface module 3, it becomes impossible to control the input/output of the entire input/output unit 2, and the loss of control device functionality is large, often making plant control impossible. Since both of the connected devices (central processing unit 1 and input/output interface module 3) are duplicated, the system bus 2 is also necessarily duplicated.It also depends on the bus architecture. However, in the daisy-chain method, data communication between multiple input/output units 2 becomes impossible due to wire breakage, etc. Even in the case of the star-only type, data communication with at least one input/output unit 2 becomes impossible, and the basic functions of the device are significantly impaired. loss, making plant control difficult.

On the other hand, to avoid erroneous output at any time.

A full data verification method for input/output data is desirable.

In this case, duplication is performed by executing the same operation at the same time and comparing the output data, and if they match, the D
It will be the UAL method. However, improving the operating rate is also important from the perspective of controlling the entire plant, and the central processing unit 1 and the input/output interface module 3 have a self-diagnosis function.

Therefore, if a problem is detected by itself, the healthy system will continue to operate with a single layer, and when the problem is repaired, it will restart again. D
It is necessary to have a function to reconstruct UAL duplication.

FIG. 3 shows the configuration when the control device is duplicated.
Since both systems of the duplicated central processing unit 1 perform the same calculation, the timing is adjusted for each execution cycle.
In addition, in order to confirm that both systems are healthy, data communication is performed via the duplex synchronous bus C between the central processing units.

On the other hand, the duplicated input/output interface module 3 also performs data verification at the same timing each time the input/output module 4 accesses. This data verification is performed via a duplex synchronous bus d that connects the input/output interface modules 3.

However, since the input/output bus b is single-layered, data output to the input/output bus b is performed by the input/output interface module 3 having the initiative. The initiative is taken by the side that starts first when the power is turned on when both systems are healthy, and when a problem occurs in one system.

The other healthy system has the initiative.

Here, we will consider the behavior when one system detects a problem and goes down and then recovers. The healthy system is executing calculations and input/output, and in order to restart the restored system as a redundant system, the same data, parameters, etc. are transferred between the central processing units 1 and 2.
It is necessary to transmit via the multiplexed synchronous bus C. The amount of data required for restarting is large compared to the amount of communication data for synchronization confirmation when operating as a normal duplex, and if the cyclic calculation cycle is set relatively short, this calculation cycle There are times when it exceeds. In addition, the parameters and data related to the access of the input/output module 4 are sent between the input/output interface modules 3 via the duplex synchronous bus d between the input/output interface modules 3 in order to match them with the restored input/output interface module 3. There is a need to.

Conventionally, the act of making the various data of the previously operating system the same in order to restart it as a redundant system was first performed between the central processing units 1, and based on this instruction, the lower inputs were It was executed between output interface modules 3.

(Problem to be Solved by the Invention) If a malfunction occurs in any of the systems, the repair may be insufficient, or the input/output interface module 3 may fail before the operator performs a recovery action. Phenomenon that repeatedly detects a malfunction, goes down, and restarts (for example, synchronization is not achieved through the input/output interface module duplex synchronization path d due to a component defect in the duplex synchronization circuit, or the interface input/output module 3
If an error occurs each time a specific address is accessed due to a malfunction in a memory component within the CPU, the healthy system that is operating will execute all data exchange between the central processing units 1 for restart. When viewed from above, there is a problem in that maintenance of the cyclic calculation cycle is disturbed, which may be unfavorable in terms of plant control.

FIG. 4 shows the behavior and timing of the duplication operation in the conventional example. In the figure, one system of the central processing unit 1 and the input/output interface module 3 connected to this central processing unit 1 are each designated as A, and the other system is designated as B, respectively.

When the system is operating in duplex mode, the central processing unit A
, B are synchronized after the computation is completed, output instructions and input instructions are given to each input/output interface module A and H, and responses are confirmed. If a failure occurs in the input/output interface module B, synchronization cannot be achieved, and the input/output interface A operates in a single layered manner, and the central processing unit B performs a restart operation. After initialization self-diagnosis, the central processing unit A After receiving this data, it accesses the input/output interface module B, but if the input/output interface B is not restored, no response is obtained and preparations are made to restart again. On the other hand, the central processing unit A.

It is waiting for a response from the central processing unit B to confirm the establishment of duplexing, but if no response is obtained even after waiting for a certain specified time, operation resumes with single duplexing. This period of duplication establishment operation takes more time than the normal operation cycle, but it is repeated until the input/output interface module B is not restored to normal. Due to this redundancy establishment operation, it cannot be ignored that synchronization may be disrupted, especially when high-speed control is required for a healthy control device that basically performs control repeatedly at the same time. , there was a problem in that it would give a disturbance. The present invention
In view of these problems, we have developed a digital controller for synchronous duplex power control that will more reliably complete the recovery operation without causing any disturbance to the healthy system when a faulty system is automatically restored to duplex mode. The purpose is to provide

[Configuration of the Invention (Means for Solving the Problems) The present invention is intended to achieve the above object, and includes a central processing unit having a microprocessor, a plurality of input/output modules, and an input/output interface module. Each system has a self-diagnosis function, and the system in which an error is detected is disconnected and continues to operate as a single duplex, and after the error is corrected, it is automatically switched to a double duplex. In the digital controller for synchronous redundant power control that is returning to the system, the input/output interface module in the input/output unit has its own micro-
Each processor performs self-diagnosis and after confirming that there are no errors, establishes redundant synchronization between the input/output interface modules, and the central processing unit The device is characterized in that upon notification of the completion of establishment of duplex synchronization, the duplex synchronization is confirmed after self-diagnosis by its own microprocessor to confirm that there is no abnormality.

(Function) According to the present invention, if there is a problem in the input/output interface module, while synchronization is being established between the input/output interface modules, the central processing unit becomes useless for establishing synchronization. Since no data exchange is required, no disturbance is caused to the healthy system.

Also, if there is a problem with the system bus,
Since the notification of the establishment of synchronization is not transmitted from the input/output interface module to the central processing unit, the central processing unit does not need to perform unnecessary data communication for establishing synchronization, so that no disturbance is caused to the healthy system.

Furthermore, if there is a problem in the central processing unit, the central processing unit will not be able to receive notification of synchronization establishment from the input/output interface module, so the central processing unit will not perform unnecessary data exchange for synchronization establishment. Therefore, there is no disturbance to the healthy system.

(Example) The system block diagram of the digital controller for synchronous redundant power control according to the present invention is exactly the same as that shown in FIG.
The functional configuration for redundant reconstruction after the system is disconnected is different from the conventional system. That is, first, the central processing unit 1
The input/output interface module 3, which is a slave when viewed from above, performs self-diagnosis to confirm that there are no errors, establishes synchronization between the two, and transfers data from the input/output unit 2 that has established synchronization to the central processing unit 1. Notification is made via system bus a. The central processing unit 1 that has received the notification from all the input/output units 2 performs a self-diagnosis to confirm that there are no abnormalities, and then confirms duplication synchronization.Then, the central processing unit 1 of the operating system transmits all data. encourage. By having a functional configuration like this.

(1) When a defect still exists in the input/output interface module 3, synchronization cannot be established between the input/output interface modules 3, so unnecessary data transmission between the upper central processing units 1 is avoided.

(2) When there is a problem with the system bus a (for example, a defective driver or receiver element or a cable break), the synchronization establishment notification from the input/output interface module 3 to the central processing unit 1 of the system to be restored is It becomes impossible. Therefore.

During this time, the central processing unit 1 remains in a standby state and does not need to make unnecessary data transmission requests to the operating system.

(3) If there is a problem within the central processing unit 1, an error will occur during self-diagnosis, or it will become impossible to receive notifications from the input/output interface module 3, resulting in unnecessary data transmission between the central processing units 1. You don't have to make any demands.

is achieved, and no unnecessary disturbance is caused to a healthy operating system. On the other hand, in the conventional method, first, a request is made to the central processing unit 1 of the operating system to send all data, and if it goes down again due to a problem, the process repeats the process of making a new request to send all data due to recursion. there were.

This method corrects these points and eliminates the problems of the prior art.

This situation is shown in FIG. In FIG. 1, as in FIG. 4, one system is designated A, and the other system is designated B. When operating in duplex mode, input/output interface module B
When the module fails and is restored after switching to single duplexing, synchronization parameters are first exchanged between input/output interface modules A and B, and a start-up request is output to central processing unit B to notify that the restoration has been restored. Thereafter, all data is transmitted between central processing units A and B, and duplexing is restored.

[Effects of the Invention] As described above, according to the present invention, even if there is a problem in the input/output interface module, the system bus, or the central processing unit, the central processing unit can perform the necessary steps to establish synchronization. Since there is no need for unnecessary data communication, no disturbance is caused to the healthy system.

[Brief explanation of the drawing]

FIG. 1 is an explanatory diagram of the behavior of duplexing operation according to the present invention;
The figure shows a block diagram of a conventional duplexing control device, FIG. 3 shows a block diagram of a controller for synchronous duplexing power control, and FIG. 4 shows a diagram explaining the behavior of a conventional duplexing operation. . 1... Central processing unit, 2... Input/output unit,
3... Input/output interface module, 4... Input/output module, a... System bus, b... Input/output bus, C... Duplex bus between central processing units,
d... Duplex bus between input/output interface modules. (7317) Agent: Patent Attorney Noriyuki Chika (
8869) Kendai figure of the same Daishimaru

Claims (1)

[Claims] Among multiple systems composed of a central processing unit having a microprocessor and multiple input/output units, the system in which an error has been detected is disconnected and continues to operate as a single system.
In a digital controller for synchronous duplex power control that automatically returns to duplexing after error recovery, the input/output interface modules in the input/output units are connected to each other after each self-diagnosis confirms that there are no errors. The central processing unit has a function of establishing duplex synchronization between A digital controller for synchronous duplex power control characterized by having a function of confirming duplex synchronization.