JPH07334382A - Multicontroller system - Google Patents

Abstract

PURPOSE:To provide the multicontroller system for which a controller dedicated to backup is unnecessitated, reliability is improved and further, system cost is reduced. CONSTITUTION:Concerning respective normal system controllers 1a-1c, control programs A-C are stored in memories 6a-6c, and the control programs of adjacent normal system controllers are stored in memories 7a-7c for backup. Redundant controllers 1d and 1e monitor the states of all the normal system controllers 1a-1c and when any fault is detected at any one of normal system controllers 1a-1c or such a fault is reported, control is continued alternatively for the fault controller by fetching the control program of the fault normal system controller and its control program for backup from the other normal system controller with no fault through an information network 2.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multi-controller system, and in particular, it replaces a failed controller among a plurality of controllers controlling and monitoring a large-scale plant such as a steel plant or an electric power plant. ,
The present invention relates to a multi-controller system that substitutes a redundant controller and continues to control and monitor a large-scale plant.

[0002]

2. Description of the Related Art In recent years, in a control system such as PA (process automation) or FA (factory automation) for a large-scale plant such as a steel plant or an electric power plant, desired control is performed by using a plurality of controllers. ing. In this kind of system,
In order to improve the efficiency of productivity (high operation rate), a redundant configuration is provided in which a spare controller is prepared in advance to back up the controller that is in operation when a failure occurs in the controller. Therefore, it is desired to realize maintenance-free maintenance.

As a multi-controller system which is generally widely used at present, a system based on a 1: 1 backup system (duplication system) is known (Japanese Patent Laid-Open No. Hei 1).
-266634). This is a system having a redundant configuration in which a spare controller is provided for each operating controller in a one-to-one correspondence.

Further, a 1: N backup type multi-controller system has been conventionally known (Japanese Patent Laid-Open No. 4-47403). This is a system having a redundant configuration in which one spare controller is provided for N controllers that monitor and control the plant. In this system, the control unit of the input / output device connected to the one failed controller is connected to the above-mentioned backup line by the switching unit that receives the switching signal output from the one failed controller among the N controllers at the time of the failure. By switching to one controller, the redundant control program can be activated, and control by the spare controller can be started at high speed.

[0005]

[Problems to be Solved by the Invention] However, the above 1: 1
In the conventional multi-controller system that adopts the backup method described above, a backup backup controller (this is called a redundant controller) is required for each controller. Therefore, although the reliability is high, the number of redundant controllers increases as the system scale increases, and the system cost increases considerably.

On the other hand, the latter 1: N backup type conventional multi-controller system has an advantage that the system cost is low because the number of redundant controllers is small. However, there is a problem that it cannot withstand double failures and that reliability decreases when the number of N controllers that monitor and control the plant increases. There is also a problem that a redundant controller with a special configuration is required.

The present invention has been made in view of the above points, and an object of the present invention is to provide a multi-controller system which does not require a controller dedicated for backup, has high reliability, and has low system cost.

[0008]

In order to achieve the above object, the present invention provides a plurality of controllers for individually controlling a plurality of controlled objects according to a control program via corresponding input / output devices. , An information network that connects a plurality of controllers to each other, a control network that connects a plurality of controllers and a plurality of input / output devices, and a control network that is connected to a plurality of controllers via the information network. And one or more redundant controllers connected to the plurality of input / output devices via the plurality of input / output devices. The plurality of controllers are provided with holding means for holding the control programs of other controllers as backup programs together with their own control programs, and the redundant controller holds the program holding means and presence / absence of failure in all of the plurality of controllers. The monitoring means for monitoring and the control means for writing the control program and the backup program of the failure occurrence controller into the program holding means when the failure occurrence controller is identified by the monitoring means are configured.

Further, the backup programs held by the plurality of controllers are all the control programs of the plurality of controllers that are control programs of the controllers adjacent in one direction when the plurality of controllers are arranged on the ring. It is desirable that the program can be restored without holding the control program and by holding the minimum number of control programs without duplication.

Further, the control means of the redundant controller of the present invention writes the program control data including the elapsed value and the set value of the faulty controller into the program holding means via the information network and also via the control network. It is preferable to write the process input of the input / output device in the program holding means because the control of the faulty controller that failed during control can be continuously continued.

Further, a plurality of redundant controllers according to the present invention are provided, each of which is input via the information network and a priority order register which holds a priority order value indicating an order in which the faulty controller is substituted. A plurality of priority order determination means for starting the operation by the control means only when the value of the priority order register from the redundant controller is compared with the value of its own priority order register to determine the highest priority. It is desirable because it can avoid the redundant controller acting on the same time.

Further, the redundant controller operates as a redundant controller after the substitution by invalidating the value held by the priority register after the program writing operation to the program holding means by the control means is completed. It is desirable because it can be avoided.

Further, since the plurality of controllers and the redundant controller of the present invention have the same configuration, it is possible to monitor the occurrence of a failure by commonly using the information network, and a dedicated switching device is unnecessary. Is desirable.

[0014]

In the present invention, the redundant controller monitors whether or not a failure has occurred in all of the plurality of controllers by the monitoring means, and when the controller in which the failure has occurred is identified,
Since the control unit writes the control program and the backup program of the faulty controller into the program holding unit respectively, the redundant controller is used as a faulty controller instead of providing a special switching device between the controller and the input / output unit. can do.

[0015]

Embodiments of the present invention will now be described with reference to the drawings.

FIG. 1 shows a system configuration diagram of an embodiment of the present invention. In the figure, controllers 1a, 1b and 1c are controllers (hereinafter, referred to as normal system controllers) that are executing control of the equipments 5a, 5b and 5c, respectively. The controllers 1d and 1e are redundant controllers. These three normal system controllers 1a to 1c and the two redundant controllers 1d and 1e are connected to each other via the information network 2, and collect their status information by, for example, a token bus system, While being configured to be monitored, it is connected to the process input / output devices (PI / O) 4a to 4c via the control network 3.

Each of the PI / Os 4a to 4c is composed of a network controller, a digital input (DI), an analog input (AI), a digital output (DO), an analog output (AO), etc., via a connecting cable. Are connected to the corresponding facilities 5a to 5c of the large-scale plant.

The normal system controller 1a performs an operation in accordance with the control program A of the memory 6a based on the process inputs such as the motor rotation speed, the valve opening degree and the temperature, which are input from the equipment 5a through the PI / O 4a. , A motor voltage, a valve opening / closing signal, a heater on / off signal, etc. are generated, and these signals are supplied to the equipment 5a via the PI / O 4a to control the equipment 5a. Similarly, the regular system controller 1b stores the equipment 5b in the memory 6b via the PI / O 4b.
The normal system controller 1c controls the equipment 5c to the memory 6c via the PI / O 4c.
Control according to the control program C in the above.

In each of the normal system controllers 1a to 1c, the control programs A to C are stored in the memories 6a to 6c, respectively, while the control programs of the adjacent normal system controllers are stored in the memories 7a to 7c for backup. It is stored in. Here, the controller 1a has its own control program A in the memory 6a and the control program B for the controller 1b in the memory 7a as backup programs. The controller 1b has a memory 6b
Has its own control program B, and the memory 7b has a control program C for the controller 1c as a backup program. The controller 1c has its own control program C in the memory 6c, and has the control program A of the controller 1a in the memory 7c as a backup program.

The rules for holding the backup program will be described in more detail with reference to FIG. The normal-use controllers 1a to 1c are respectively shown in FIG.
When the backup program is arranged clockwise as shown in, the backup program is the control program of the controller adjacent in the clockwise direction. That is, the memory 7 of the controller 1a
The control program B of the controller 1b adjacent in the clockwise direction is stored as a backup program in a, and the control program B of the controller 1c adjacent in the clockwise direction is stored as a backup program in the memory 7b of the controller 1b. The memory 7c stores the control program A of the controller 1a adjacent in the clockwise direction as a backup program.

By thus forming the rules, the backup programs can be easily provided to the controllers 1a to 1c without duplication. Further, according to the above rule, when the controllers are arranged in the counterclockwise direction, the control program of the controller adjacent in the counterclockwise direction may be held as a backup program, which can be easily inferred from the above description. Is.

In FIG. 1, the redundant controllers 1d and 1e monitor the states of all the normal system controllers 1a to 1c, and when any one of the normal system controllers 1a to 1c is detected as a failure or a failure occurs. Is reported, the control program of the faulty working system controller and the backup control program are taken in from another non-failing working system controller via the information network 2 and replaced by the faulty controller. Continue control.

For example, when the normal system controller 1a has failed, the redundant controller 1d or 1e is connected to the failed normal system controller 1a via the information network 2.
The control program A is read from the memory 7c of the normal system controller 1c which has not failed and is loaded, and
The backup program B is read and loaded from the memory 6b of the normal system controller 1b which has not failed. As a result, the redundant controller 1d or 1e has the control program A and the backup program B for the failed normal system controller 1a, respectively.

Similarly, when the normal system controller 1b fails, the redundant controller 1d or 1e reads the control program B of the failed normal system controller 1b from the memory 7a of the non-failed normal system controller 1a and fetches it. , Again, backup program C
Memory 6a of the normal system controller 1c which has not failed
Read from and capture. In addition, the regular system controller 1
If c fails, the redundant controller 1d or 1
e reads the control program C of the failed normal system controller 1c from the memory 7b of the normal system controller 1b that has not failed and fetches it, and reads the backup program A from the memory 6a of the normal system controller 1a that has not failed. Take in.

After repair, the failed controller is installed and operates as a redundant controller. Since the failed controller may be left without being repaired, the redundant controller 1f or the like can be further added or installed in advance. When there are a plurality of redundant controllers, the proxy priority order is determined in advance.

Next, the internal configuration of the regular system controller will be described with reference to FIG. Regular system controller 1a ~
Since each of the 1c has the same structure, a block diagram of one embodiment of the normal system controller 1a is shown as a representative in FIG. 3, those parts that are the same as those corresponding parts in FIG. 1 are designated by the same reference numerals,
The description is omitted.

The regular system controller 1a includes a memory 6a,
7a, arithmetic processor 8, information network processor 10, control network processor 11 and PI
/ O transfer data memory 12 and the like,
It also has a self-diagnosis device (not shown). In addition,
Memories 6a, 7a and memory 1 for PI / O transfer data
2 may be configured by the same memory.

The information network processor 10, the control network processor 11 and the memories 6a and 7a are connected via a system bus 13, and the arithmetic processor 8 is connected via the memories 6a, 7a and 12 and a local bus 14. Connected (note that memory 7 is shown in FIG. 3)
Illustration of the local bus 14 between a and the processor 8 is omitted. ). The control program A stored in the memory 6a is the A control program 15a.
And A controller set value 16a and A controller elapsed value 17a. Similarly, the backup program B stored in the memory 7a includes a B control program 15b, a B controller set value 16b, and a B controller elapsed value 17b.

Next, the operation of the normal system controller 1a will be described. Information network processor 10
Is usually the B controller elapsed value 17b sent from the normal system controller 1b through the information network 2.
Is written in the memory 7a via the system bus 13.
When another controller fails, the information network processor 10 reads the control program A or the backup program B from the memory 6a or 7a and sends it to the information network 2 in response to the program transmission request from the redundant controller. To do. In this way, the information network processor 10 can directly read and write the memories 6a and 7a in the controller 1a.

Further, the information network processors 10 in each of the regular system controllers connected to the information network 2 respond to each other and monitor the responses of all the controllers. The failed controller stops output after sending failure information such as the name of the failed controller by the self-diagnosis device. Therefore, the controller that has not failed can receive the response from the failed controller, and thus can recognize the failed controller.

Further, the arithmetic processor 8 operates in parallel with the operations of the information network processor 10 and the control network processor 11, and sets the A controller set value 15
a is read from the memory 6a, PI / O data such as the motor rotation speed, the valve opening / closing degree, and the temperature, which are process inputs, are read from the memory 12 and the A control program 15a is executed, and the count value of the counter and the timer elapse. A controller elapsed value 17a such as value is stored in the memory 6a
And the writing of PI / O transfer data such as a motor voltage, a valve opening / closing signal, and a heater on / off signal, which are process outputs, in the memory 12 is repeated.

Further, the control network processor 11
Is required by taking in the process input of the equipment 5a sent by the PI / O 4a, the process input of the equipment 5b sent by the PI / O 4b, or the process input of the equipment 5c sent by the PI / O 4c via the control network 3 in FIG. According to (in accordance with the user definition), it is written in the memory 12 as PI / O transfer data. The control network processor 11 also reads the PI / O transfer data from the memory 12 and sends it to the control network 3 as a process output to control the equipment 5a.

Next, the internal structure of the redundant controller will be described with reference to FIG. Redundant controllers 1d and 1
Since e have the same configuration, the block diagram of one embodiment of the redundant controller 1d is representatively shown in FIG. 4, the same components as those in FIGS. 1 and 3 are designated by the same reference numerals.

The redundant controller 1d has basically the same structure as the normal system controllers 1a to 1c, but has a rule register 9, a supervisory processor 18 and a priority register 19 which are mutually connected to the system bus 13. Is characterized by.

Next, these operations will be described. The monitoring processing processor 18 determines the failed normal system controller from the response monitoring results collected by the information network processor 10, thereby determining the backup source controller of the control program and the backup program, and the rule read from the rule register 9 Based on the above, the information network processor 10 is notified of the backup source controller name and the necessary program name.

The information network processor 10 that has received this notification makes a program transmission request to the corresponding normal system controller via the information network 2. The control program and the backup program transmitted from the normal system controller that has received the transmission request via the information network 2 are taken in via the information network 10 in the redundant controller 1d in FIG. The same control program as that of the controller is stored, and the same backup program as that of the failed normal system controller is stored in the memory 7d.

For example, when the controller 1b of FIG. 1 fails, the redundant controller 1d controls the backup program B of the controller 1a arranged counterclockwise according to the rule (stored in the rule register 9) described with FIG. Write to the memory 6d as a program,
The control program C of the controller 1c arranged clockwise is written in the memory 7d as a backup program. Reference numerals 15c, 16c and 17c in FIG. 4 denote the controller program, the controller set value and the controller elapsed value of the program B, which is the above-mentioned control program, and 15d, 16d and 17d,
The controller program, the controller set value, and the controller elapsed value of the program C, which is the backup program, are shown respectively.

In this way, since the redundant controller has the same control program and backup program as the failed normal system controller, the redundant controller can be used as the failed normal system controller.

Here, when there are a plurality of redundant controllers, if there is a plurality of redundant controllers for one failed controller, it is necessary to determine which redundant controller should be replaced by the failed controller. A priority register 19 is provided to determine this alternate redundant controller. The priority order can be determined in the order in which the power is first turned on or the order defined by the switch.

The redundant processors 1d and 1e take in the value of the priority register 19 in the other redundant processor via the information network 2 and, for example, the supervisory processor 18 compares it with the value of its own priority register 19, When the value of its own priority register 19 is the minimum, the above program restoration operation is performed. After the program restoration operation is completed, the value of the priority register 19 is invalidated. This is because the redundant processor has become the regular processor.

Normal-use controllers 1a to 1 having the above-mentioned configuration
According to the present embodiment using c and the redundant controllers 1d and 1e, the redundant controllers 1d and 1e can fetch the program of the faulty controller from another normal system controller via the information network 2, so that a dedicated backup device is not required. Therefore, the equipment cost can be reduced.

Further, as shown by 1d, 1e and 1f in FIG. 1, a plurality of redundant controllers can be installed regardless of the number of the normal system controllers 1a to 1c. It is possible to build a system that flexibly responds to such situations. Moreover, since the controllers are connected via the information network 2 and the control network 3, the number of wires can be reduced.

By the way, as described above, the normal system controllers 1a to 1c and the redundant controllers 1d and 1e are
Although the operating components are slightly different, the basic configuration is almost the same. Therefore, in consideration of cost reduction due to mass production and addition of a controller in the system, it is desirable that both configurations are the same. FIG. 5 is a block diagram showing the internal configuration of the controller in this case. In the figure, the same components as those in FIGS. 1, 3 and 4 are designated by the same reference numerals.

In FIG. 5, the controller 1 has memories 6, 7, an arithmetic processing processor 8, a rule register 9, an information network processor 10, a control network processor 11, a monitoring processing processor 18, a priority register 19, and the like. Are connected to each other via the system bus 13. In addition, the arithmetic processor 8
Are memories 6 and 7, PI / O transfer data memory 1
2 and the like are also connected via a local bus 14.
The PI / O transfer data memory 12 is connected to the control network processor 11 via the data bus 20.

Further, 15 and 15 'are control programs, 16 and 16' are controller set values, 1
7 and 17 'are controller elapsed values, which are of different programs. As described above, in this embodiment, the controller 1 includes the arithmetic processing processor 8 which is a constituent part of the regular system controller, the rule register 9 which is a constituent part of the redundant controller, and the monitoring processor 1.
8 and the priority register 19 together,
Both normal system controller and redundant controller operations are possible. When this controller 1 is used, a dedicated switching device between the normal system controller and the redundant controller is not required, so that the equipment cost can be reduced.

The present invention is not limited to the above embodiment, and for example, the arithmetic processor 8 and the monitor processor 18 may share the same processor.

[0047]

As described above, according to the present invention,
Since a redundant controller can be used as a failure occurrence controller instead of providing a special switching device between the controller and the input / output device, the equipment cost can be reduced as compared with the 1: 1 backup method, and
Compared to the N-backup method, it is possible to deal with double failures, so it is possible to improve reliability and build a multi-controller system that can flexibly respond to the required budget and reliability. it can.

[Brief description of drawings]

FIG. 1 is a system configuration diagram of an embodiment of the present invention.

FIG. 2 is a diagram illustrating a possession rule of a backup program of a controller according to the present invention.

3 is a block diagram of an embodiment of the service controller of FIG. 1. FIG.

4 is a block diagram of one embodiment of the redundant controller of FIG.

FIG. 5 is a block diagram of a controller that shares a normal system controller and a redundant controller.

[Explanation of symbols]

1 ... Controller, 1a-1c ... Regular system controller,
1d to 1f ... Redundant controller, 2 ... Information network, 3 ... Control network, 4a-4c ... Process input / output device (PI / O), 5a-5c ... Equipment, 6, 6a-6
d, 7, 7a to 7d ... Memory, 8 ... Arithmetic processor, 9 ... Rule register, 10 ... Information network processor, 11 ... Control network processor, 12 ... P
I / O transfer data memory, 18 ... Monitoring processor, 19 ... Priority register.

Claims (6)

[Claims] 1. A plurality of controllers that individually control a plurality of controlled objects according to a control program through correspondingly provided input / output devices, and an information network that connects the plurality of controllers to each other. A control network connecting between a plurality of controllers and the plurality of input / output devices, and connected to the plurality of controllers via the information network, and connected to the plurality of input / output devices via the control network And one or more redundant controllers, and the plurality of controllers, together with its own control program, a holding unit for holding a control program of another controller as a backup program, the redundant controller, A failure occurred in the program holding means and all of the controllers. And a control unit that writes a control program and a backup program that the faulty controller has in the program holding unit when the faulty controller is identified by the monitoring unit. Controller system. 2. The backup program held by the plurality of controllers is a control program for controllers located adjacent in one direction when the plurality of controllers are arranged on a ring. 1. The multi-controller system according to 1. 3. The control means of the redundant controller writes the program control data including the elapsed value and the set value of the failure occurrence controller to the program holding means via the information network, and the front control via the control network. 2. The process input of the entry output device is written in the program holding means.
The described multi-controller system. 4. A plurality of the redundant controllers are provided, each of which has a priority order register for holding a value of a priority order indicating an order in which the faulty controller is to be substituted, and another redundancy input via the information network. 7. A priority order determination means for starting the operation by the control means only when the value of the priority order register from the controller is compared with the value of its own priority order register to determine the highest priority. 4. The multi-controller system according to any one of 1 to 3. 5. The multi-controller according to claim 4, wherein the redundant controller invalidates the value held in the priority register after the program writing operation to the program holding unit by the control unit is completed. system. 6. The multi-controller system according to claim 1, wherein the plurality of controllers and the redundant controller have the same configuration.