JPH0441361B2 - - Google Patents

Description

[Detailed Description of the Invention] [Technical Field of the Invention] The present invention relates to a system in which a controlled object is controlled by a plurality of controllers that exchange information with each other using communication lines. This invention relates to a backup method in which a backup controller provided in advance takes over the operation when a failure occurs in one of the backup devices.

When the object to be controlled is so large that it cannot be controlled completely by a single controller, multiple controllers are connected through a dedicated communication line and controlled while transmitting information to each other. Generally, a configuration is used in which a backup controller is provided in addition to these main controllers, and when a failure occurs in the main controller, this backup controller takes over the operations of the main controller.

[Prior art]

In such a backup method, a backup memory is provided that receives database transfer from each main controller, and the backup controller transfers the database corresponding to the main controller from the backup memory when a failure occurs in the main controller. It receives the request and starts acting on its behalf.

By the way, the contents of such a backup memory, ie, backup data, are normally updated at a constant sampling period. Therefore, if a failure occurs after one of the main controllers receives a command, the backup controller that takes over the operation of the failed main controller will retrieve the update corresponding to the command from the backup memory. Since the substitute operation is started in response to data transfer before the data is transferred, there is a risk of inconsistency in the control operation of the entire system.

[Object and structure of the invention]

The present invention has been made in view of the above circumstances, and its purpose is to provide a method for backing up a multiple controller system that can prevent loss of transmitted information during backup and operations based on inconsistent information. It is in.

In order to achieve such an objective, the present invention
Dedicated signal lines are provided to notify various controllers of the occurrence of a backup, and if the main controller that is notified of the occurrence of a backup is transmitting information to other main controllers at that time, the same information will be transmitted repeatedly. While doing so,
The control output value is calculated in the first cycle, and the calculated output value is sent to the communication line in the next cycle.

Here, the transmission of information between the controllers is completed when the backup data corresponding to the receiving main controller is completed. Hereinafter, the present invention will be explained in detail using Examples.

〔Example〕

FIG. 1 is a block diagram showing one embodiment of the present invention, in which a plurality (N) of main controllers MDC ₁ to
MDC _N and one backup controller BDC
and a backup director which monitors the operating states _{of the main controllers MDC 1 to MDC N and gives commands} to the switching devices SW ₁ to SW _N , as will be described later. DRT is provided. Each of these components has a processor such as a microprocessor.
CPU _n1 ~ CPU _nN , CPU _b , CPU _S1 ~ _{CPU SN} ,
Fixed memories ROM _n1 ~ ROM _nN , ROM _b , ROM _S1 ~ each equipped with a CPU _d and connected by a bus
Predetermined operations are executed based on instructions stored in ROM _SN and ROM _d .

Each of the main controllers MDC ₁ to MDC _N connects the control target via interfaces I/F _n1 to I/F _nN and input/output circuits I/O _n1 to I/O _nN that have a conversion function between analog signals and digital signals. It receives outputs from sensors SS ₁ to SS _N such as flow meters in the process, and sends control outputs to operating terminals in the process, such as valves MV ₁ to MV _N. That is, sensors SS ₁ to SS _N
Based _on the _output of
This determines the control output value and performs control operations for the process.

In addition, each main controller MDC ₁ to MDC _N has a watchdog timer WDT ₁ to WDT _N for monitoring the operation of the processor CPU _n1 to CPU _nN , respectively.
are provided, and the monitoring output from this and the results of self-diagnosis performed by the processors CPU _n1 to _{CPU nN} at a constant sampling period as described later are transferred to the switching devices SW1 to _SW1 through OR gate circuits _G1 to _GN . SW _N
At the same time, the variable memory RAM _n1 ~
The database necessary for control in RAM _nN is sent to switching devices SW ₁ -SW _N via backup memories BFM _n1 - BFM _nN .

Furthermore, each of the main controllers MDC ₁ to MDC _N is provided with communication interfaces SR _n1 to SR _nN , through which information or commands (hereinafter referred to as commands, etc.) required for control are sent and received via communication lines L. It has become something to do.

On the other hand, the switching devices SW ₁ to SW _N receive the database from the backup memories BFM _n1 to BFM _nN via the interfaces I/F _S1 to I/F _SN at a constant sampling period, and thereby the variable memory RAM The contents of _S1 to RAM _SN are updated to prepare for the occurrence of a failure in the main controllers MDC ₁ to MDC _N. That is, variable memory RAM _S1 ~
RAM _SN has a backup memory function.

In contrast, the backup controller BDC
is normally in a standby state, but for example, if the main controller MDC ₁ goes down, the fault signal sent from the OR gate G ₁ in response to the occurrence of a fault in the main controller MDC ₁ is sent to the interface I/
When received by the switching device CPU _S1 via F _S1 ,
Receives database transfer from variable memory RAM _S1 via interface I/F _S1 and backup memory BFM _b , and stores it in its own variable memory.
After storing it in RAM _b , control operation is started according to this content. In other words, the backup controller BDC receives the output from the sensor SS ₁ via the interface I/F _b and the input/output circuit I/O _b , which has the same function as the input/output circuit I/O _n1 , and performs control calculations. determine the control output value and set it to the valve MV ₁ .
At the same time, commands required for control are exchanged with other main controllers via the communication interface SR _b via the communication line L.

In addition, the backup director DRT is
OR gate G ₁ via interface I/F _S1 ~ I/F _SN and own interface I/F _d
While monitoring the fault signal from ~G _N , when a fault signal occurs, the switching device SW ₁ ~ SW _N transfers the database required for control in the variable memory RAM _S1 ~ _{RAM SN} to the backup controller BDC. If there is no failure, a database update command is sent and the signal line C1, interface I/
Switch S ₁ in switching device SW ₁ to SW _N via F _d
~S _N , and the input/output that was previously performed between the process and the main controllers MDC ₁ ~ MDC _N is now performed between the failed main controller and the backup controller BDC. Signal line C that is to be switched
2. These conditions are sequentially stored in the variable memory RAM _d , and information about which controller is currently executing the control operation is held. In addition, from the director DRT, interface I/F _d and interface I/F _n1 to I/
F _nN , each controller MDC ₁ through I/F _d
A signal line C3 is configured to send a control signal to MDC _N and BDC, thereby instructing them to stop the operation and start the substitute operation in response to the occurrence of a fault.

However, for normal control operations in each main controller MDC ₁ to MDC _N and backup controller BDC, a sampling period for capturing the outputs of sensors SS ₁ to SS ₂ is determined, and control calculations and control operations are performed according to this sampling period. The output is sent out.

Here, the interface I/F _d of the director DRT and each controller MDC ₁ to MDC _N ,
BDC interface I/F _n1 ~ I/F _nN ,
A dedicated signal line CR is provided to connect with I/F _b .
If a backup occurs by the backup controller BDC due to a failure in one of the main controllers, the other main controllers MDC ₁ to MDC _N are notified of this. In other words, if a backup occurs, the switching device
The database stored in variable memory RAM _S1 to _{RAM SN} of SW ₁ to SW _N is transferred to variable memory RAM _b of backup controller BDC,
From the start of this backup until the end of the database transfer, a signal indicating the true value is sent to the signal line CR.

Next, the control operation in the above configuration will be explained using the flowcharts of FIGS. 2 and 3.

First, FIG. 2 is a flowchart showing the main processing operations in each main controller. In other words, after self-diagnosis, each main controller MDC ₁ to MDC _N updates the backup data according to the latest control calculation results, and subsequently provides necessary control to other controllers via the signal line L. Convey the above instructions, etc. Next, the process valves MV ₁ to MV _N are adjusted according to the latest control calculation results above.
Sends control output to sensor SS ₁
~SS After taking in the output from _N , control calculations are performed based on the latest data. However, in this last step, only the control output value is determined, and the actual output to the process and the sending of commands to other controllers via the communication line L are performed in the corresponding steps of the next cycle.

Here, if it is notified that the signal line CR becomes the true value and a backup has occurred while transmitting commands to other controllers, the main controllers MDC ₁ to MDC _N transmit the same content. Retransmit the command.

FIG. 3 is a flowchart showing the command transmission processing operation to other controllers via the signal line L. i.e. each main controller MDC ₁
~MDC _N sends the necessary commands to other desired main controllers, but unless the signal line CR becomes the true value during the process, it confirms that the command transmission is complete and then executes this command transmission processing routine. exit,
Move to the input/output step during the next process.
As mentioned earlier, the transmission of the above command is the up-date of backup data on the receiving side, that is, the data received on the receiving side controller is transferred to the variable memory RAM _S1 of the corresponding switching devices _SW1 to _SWN .
~It is considered complete when it is stored in RAM _SN , but as mentioned above, the receiving controller also automatically updates the backup data at a fixed sampling period, so it is necessary to confirm the completion of this transmission. This can be done by confirming that a predetermined period of time, ie, the backup data update cycle period has elapsed.

Therefore, if a backup occurs in another main controller and the signal line CR becomes the true value before the above transmission is completed, the controller that was transmitting this command will continue to operate until the true value disappears, that is, as mentioned earlier. Until the database corresponding to the faulty controller stored in one of the variable memories RAM _S1 to _{RAM SN} of the switching devices SW ₁ to SW _N is transferred to the variable memory RAM _b of the backup controller BDC. After waiting, the command is sent again. After that, since the communication line CR does not normally become the true value again, it takes time for the transmission to complete. Since this command transmission processing routine waits for a certain period of time, that is, the backup data update cycle period has elapsed, it is necessary to check whether the communication line CR is the true value again after re-executing the transmission in this way. , before the command transmission is completed, that is, on the receiving side, the database is switched to the switching device SW ₁ to _{SW N}
If another main controller fails before data is stored in variable memory RAM _S1 to RAM _SN , and this second controller has a higher backup priority, the backup controller BDC This is because, at that point, the backup of the first failed controller may be stopped and the backup of the second controller may be started. That is, in this case, the command is repeatedly sent to the backup controller BDC for backup of the second main controller.

For example, when each of the main controllers MDC ₁ to MDC _N recycles as shown in FIG. 2, and the backup controller BDC is in a standby state, the main controller MDC ₁ may fail during a certain cycle. It is assumed that the backup is performed by the backup controller BDC. At this time, the other main controller MDC _N connects the communication line L to the main controllers MDC ₁ and MDC _K.
If commands are transmitted via the variable memory RAM _S1 of the switching device _SW1 ,
After the backup data is transferred to RAM _b , the main controller MDC _N again executes the transmission of the above command. In this case, the backup controller
Since the BDC is in a backup state (standby) and is adapted to receive the communication device address of the main controller MDC ₁ , the above command is transmitted to the backup controller BDC and the main controller MDC _K. This allows the backup controller BDC to obtain the latest data. Note that re-execution to the main controller MDC _K is originally unnecessary, but since the main controller MDC _N that transmits commands has only one communication line CR as a backup status line, Since it is not possible to determine whether a backup has occurred in the controller, re-execution is performed unconditionally. dedicated communication line
Multiple CRs, for example 8 main controllers (N=
If 4 lines are used in case 8), and one line indicates whether or not a backup has occurred, and the other three lines (2 ³ = 8) indicate the main controller that has been backed up, the main controller MDC that does not require re-execution can be used. It is possible to prevent _K from being re-executed.

Figure 4 shows the update period of backup data of the main controller N, backup occurrence, and signals.
This is a timing chart showing the interrelationship between CR operation and backup controller operation.

_{to _ _ _ _ _} At time t _B , the main controller N fails and stops operating, a backup occurs, and CR becomes the true value, and the variable memory
The database stored in RAM _SN is transferred to the variable memory RAM _b of the backup controller BDC, and when the transfer is completed, the signal CR becomes a false value.
The backup controller takes over the communication address of the main controller N and performs operations on its behalf.

Here, since the command S sent from the other main controller between time t _o+2 and t _B has not been transmitted to the backup controller, the main controller N
It is necessary to resend the same command S to this address. Therefore, each main controller may end the transmission of the command after the backup data update cycle time has elapsed after the command is sent.

Note that in the embodiment described above, completion of up-dating of backup data was determined by the receiving controller after a certain period of time had elapsed.
Of course, this also applies to the processor CPU _S1 of the switching device.
The CPU _SN may send a signal indicating the completion of the above update, and the main controller that resends the command may determine the completion based on whether or not it receives this signal. .

Also, in the flowchart shown in Figure 2, the control calculations are performed in the final step and the results are not immediately output to the process or sent to other controllers. When this happens, the up-dating of the backup data has not been completed, so there is a mismatch between the control calculation results performed by the backup controller acting on behalf of the main controller and the calculation results performed by the main controller that was backed up. This is because a state mismatch may occur between the process that has received the latest data and other main controllers. That is, if the results of the control calculations shown in the flowchart of FIG. 2 are immediately output, and the database is subsequently down and backed up, the database will not contain the latest data of the calculation results. Based on this slightly old database, we then import process inputs and perform control calculations again.
Due to this time difference between input samples, the control calculation results may differ. For this purpose, the backup data is updated and then sent to other controllers or output to a process.

〔Effect of the invention〕

As explained above, according to the present invention, each main controller is provided with a dedicated signal line for notifying the occurrence of a backup, and the main controller that is notified of the occurrence of a backup transmits information to other controllers at that time. If so, transmit the same information repeatedly, calculate the control output value in the first cycle, and send that output value in the next cycle to avoid loss of transmitted information during backup. and inappropriate operations based on inconsistent data can be effectively prevented.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing one embodiment of the present invention;
Fig. 2 is a flowchart showing an example of a main routine program in the main controller, Fig. 3 is a flowchart showing an example of a command transmission routine program to another main controller, and Fig. 4 is a timing chart explaining backup operation. . MDC ₁ ~ MDC _N ...Main controller, BDC...
Backup controller, RAM _S1 ~ RAM _SN ...
...Variable memory (backup memory), CR...Signal line that notifies the occurrence of backup.

Claims (1)

[Claims] 1. Each performs control calculations and cyclically transmits control information to each other via a communication line,
A plurality of main controllers each having a unique communication device address, a backup memory that receives database transfers from each of these main controllers at regular intervals, and a In a multi-controller system equipped with a backup controller that acts on behalf of the controller, when a failure occurs in one of the main controllers, each of the main controllers is notified of the occurrence of a backup via a dedicated signal line, When the occurrence of a backup is notified, the communication device address of the failed main controller is given to the backup controller, and data corresponding to the failed main controller is supplied from the backup memory to the backup controller.
The backup controller takes over the operations of the failed main controller, and if the main controller that was notified of the backup was transmitting information to another main controller at that time, it takes over the failed main controller. 1. A method for backing up a multiple controller system, comprising the steps of: a backup controller that performs a backup, and a step of transmitting the same information again to the other main controllers except for the failed main controller.