JPH08202409A - Decentralized control unit, system, and controller - Google Patents

Abstract

PURPOSE: To provide a controller which has many kinds of various control function for a decentralized control system. CONSTITUTION: Controllers 1-6 consist of plural processors which perform numerical operation, sequence operation, neural net(NN) operation, fuzzy operation, etc. The controllers 1-6 are reduced in size by the configuring technology with LSI. Further, processor functions and I/O functions are made programmable to increase flexibility. A program incorporates a simple standard program and learnt models of the NN, etc., and weights and adds plural calculated outputs to generate output data. Further, the value of weighting is updated by learning. Consequently, the decentralized control system having many kinds of various control function such as numerical operation control, sequence control, NN application control, and fuzzy application control and the controllers used for them can be provided.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a distributed control system for performing distributed control by using a plurality of control devices (controllers) in various process control, plant control, vehicle control and the like.

[0002]

2. Description of the Related Art Conventionally, as an example of a plant control system, there is a control system called DCS (Distributed Control System), which is a distributed control system for controlling a plurality of controllers in a distributed manner. This DCS connects a plurality of controllers and an operator's console as a man-machine system via a network to control the plant. However, even in the case of a distributed system, it is common to arrange the controllers themselves in a dedicated installation space called an instrument room, electric room, computer room, etc., and connect input / output cables to the sensors or actuators of the plant from there. It was However, this method has a problem in that a dedicated installation space for the controller is required and that it is expensive to lay out a connecting cable between the controller input / output and the plant.

Further, if the conventional controllers are distributedly arranged, there is a problem that the maintenance cannot be performed immediately when the controller fails.

In general, one plant is composed of a plurality of control target groups, and one control target group is composed of a plurality of control target devices. Therefore, it has been conventionally discussed how many control target devices are controlled by one controller. Generally, the smaller the number of controlled devices controlled by one controller, the smaller the influence range and the more decentralized risk even if one controller fails, but the communication volume between controllers increases. There was a problem.

On the other hand, the sophistication of control is further advanced in the future, and not only sequence control which is an alternative to relay contact logic and mere numerical operation control but also high-speed matrix operation for performing multivariable control and fuzzy handling of ambiguous amount Various types of control such as neural network applied control with control and learning ability are being used in combination. However, such a control system is currently constructed by appropriately combining controllers each having a dedicated function. As a result, a high degree of control requires the placement of multiple controllers in a distributed system, adding complexity and associated costs at any point during design, programming, operation or maintenance. There was a problem of doing.

Also, a controller having a so-called multiprocessor structure in which one controller is realized by a plurality of processors has been realized. For example, the controller is realized by a plurality of processors such as a network control processor, a numerical operation processor, and a high-speed sequence processor that perform transmission processing. However, in the conventional method, it is necessary to prepare a plurality of types of processors according to various control contents and change the combination according to the control target. That is, sensors of various controlled objects,
Since the type of actuator, number of points, and control content are different,
Each processor and process I / O card are designed to be plug-in unit type so that they can be added and replaced. However, if this controller is to be integrated into a single board or an LSI, a very difficult situation occurs. In other words, a board or LSI with different functions will be created for each control target, which will be a major obstacle in terms of development period and development cost, and also in terms of maintenance, maintenance parts and maintenance management compatible with all types will be required. , Leading to an increase in maintenance costs. In particular, one of the merits of making LSI is the cost reduction due to mass production, and in this way many types of LS are individually available.
The development of I means that the maximum merit of this LSI cannot be enjoyed.

With regard to programming of the controller, the user conventionally wrote the programs of the respective control units one by one. Generally, the program becomes complicated to obtain better control performance. Moreover, it is very difficult for the conventional program to flexibly respond to changes over time, changes in the environment, and user preferences. Therefore, there is an approach to improve controllability while gradually learning by using a neural network or the like. However, in the conventional learning approach, a large amount of learning and experience must be gained before the desired output is obtained, and in the initial stage of learning, only a control output that is far from the desired control output can be obtained. It is always. On the other hand, it is also true that a value close to the desired control output must be obtained from the initial stage of control. In addition, there is a demand for a method of maximizing the use of knowledge that the user has,
It is difficult to judge which is better, the learning result by neuro or the like or the user's knowledge.

Further, with respect to the evaluation of the control performance, there are often a plurality of criteria such as riding comfort, speed, temperature, etc., as in the case of an automobile. Also, the standard of value varies from person to person, and even the same person from time to time. In order to flexibly deal with such a situation, it is necessary that the user can change the value criterion calculation method during operation.

Regarding the network, if the controlled object is in a steady state, the communication information amount does not increase or decrease much, but in the transient state, especially when an abnormality occurs, the communication information amount increases. For example, even with a blackboard architecture, which is a conventional method for diagnosing a distributed control system, there is a risk that a large number of pieces of failure information will be transmitted from the individual controllers to the communication network when a common mode failure occurs and a network communication neck will occur.

Further, in order to improve the operating rate and reliability of the distributed control system, it is general to use a method in which when one controller fails (down), another controller substitutes (backs up) the load. . For example,
As disclosed in JP-A-62-177634 and JP-A-63-118860, there is known a method of predefining a controller to be backed up when a certain controller goes down. Further, JP-A-2-224169 and JP-A-3-296851
In the computer system, there is known a method in which the load of a down computer is divided and backed up by a plurality of computers according to the load status of each computer as shown in No. However, in the former method, it was necessary to prepare a controller dedicated for backup. In the latter method, the load distribution is centrally managed, so that if the computer for centralized management goes down, the entire computer system may stop.

[0011]

SUMMARY OF THE INVENTION One of the problems to be solved by the present invention is to realize a control system which can minimize the number of control target devices held by a single controller and can disperse danger. It is to be.

Further, another problem to be solved by the present invention is to provide a distributed installation type control system capable of eliminating or minimizing the installation space for exclusive use of the controller and the laying of the connecting cable between the input / output of the controller and the plant. Is to realize a controller that can also be applied.

Still another object of the present invention is to provide a versatile controller that can handle various types of control objects and control methods with the fewest possible types.

Still another object of the present invention is to provide a compact and low cost controller.

Further, another problem to be solved by the present invention is to provide a controller having a scalability capable of being configured with the same architecture from a small scale controller to a large scale controller.

Further, another object of the present invention is to provide a controller capable of programming a function according to the purpose after completion of hardware. The program of the function referred to here is to embed a dedicated processing function such as a numerical operation function, a fuzzy inference function, a neural network processing function, a sequence operation function in the hardware in the controller.

Still another object of the present invention is to provide a controller capable of self-repairing against partial failure.

Still another object of the present invention is to provide a control system with simple programming.

Further, another problem to be solved by the present invention is to reduce the failure information transmitted from the individual controllers to the communication network at the time of the common mode failure so that the system down due to the communication neck of the network is less likely to occur. To provide a distributed control system.

Further, another problem to be solved by the present invention is to autonomously reduce the load of a controller that is operating normally without providing a controller for centralized management and a controller for standby. It is to realize a distributed control system that can be divided and backed up. Especially when multiple controllers are down, the controllers that are operating normally cooperate with each other.
It is to effectively utilize the surplus performance and perform backup to the limit of the total performance of the distributed control system.

[0021]

In order to solve the above problems, according to the present invention, it is assumed that the controller has an expandable internal structure and external structure, and its basic unit is an LSI so that a small controller can be realized. did. Therefore,
It can be used as a distributed installation type or a centralized installation type. Also, by arranging this controller in units of control target devices, a risk distribution system can be realized.

Further, in order to realize a controller having general versatility, a single controller is used to perform a numerical operation function as well as a parallel operation function for high-speed operation of neuro, fuzzy, matrix, etc., and a sequence control operation. It is composed of multiple processors, such as a processor for executing high-speed communication, and a processor for executing a communication function with a network, and each function can be executed in parallel. Also provided is a method for implementing a chip capable of functionally programming an input / output and a processor.

Further, even if one processor in the same controller goes down, another processor can substitute its function.

The control calculation unit is provided with a means or method for calculating a model given by a user as in the conventional art, and the control output is generated by weighting and adding both. Then, the weighted value is set to 100% or a value close to the user's added model output in a state where learning is not progressing, and then updated by learning, and the weighted value for the output value from the neuro or other means is also changed. I decided to do it with a neural network and let it learn.

With respect to the evaluation, the evaluation value of the state is displayed to the user, and the user has a means to modify the evaluation value. Further, the user defines a new evaluation standard and the plurality of evaluation values are processed in some way. After that, the minimum value was obtained, and this was used to update the output calculation method.

Further, as means for reducing the load on the network at the time of failure diagnosis, a network monitor for storing and transmitting / editing network transmission information in a man-machine device, and an input / output information filter attached to each controller are provided for redundancy. I tried not to get such information on the network.

Further, means for autonomously dividing and backing up the load of the controller that has gone down is as follows: a task executed by each controller and an execution allocation table showing its load status; Backup request means that requests backup based on the task load table that shows the load and the reception order table that shows which controller has room to easily execute the backup depending on the load status of each controller, and the backup can be received from the above table It is configured to include a backup acceptance unit that determines whether or not it has been accepted and gives an instruction to execute the accepted task.

Further, in order to improve the fault tolerance and reliability of one controller itself, each controller is composed of a plurality of processors, and the above-mentioned execution allocation table further shows the load status of each processor and which processor has a margin. It shows whether the load can be easily backed up, and an internal backup means is provided to determine the processor that backs up the load of the failed processor according to the execution allocation table and the task load table.

[0029]

By implementing a controller capable of executing a wide variety of control functions in parallel with one type, a distributed control system having a flexible system configuration capability can be constructed. That is,
Since multiple controllers with the same hardware structure can be installed, even if one controller fails, it is easy to back up with other controllers, and the controllers can be distributed even in locations where quick maintenance is difficult. it can.

With respect to programming, the user may program a relatively simple model as the grant model. At the beginning of learning, the operation is performed according to the imparted model, and the weight value for the output of the neural network can be increased as the learning progresses and the output value of the learning model by the neural network improves. Further, by providing a state evaluation unit and evaluating the output data by time differentiation of the output, the weight value can be gradually changed by learning without the user being aware of it. Further, the weight value is obtained from the input data by a neural network, and the neural network is further trained so that the output of the added model is good when the output is good, and the output of the learning model is good when the output is good. Depending on the case, the weighting method can be changed so that the weight becomes larger.

Further, the evaluation value display means and the correction means can correct the evaluation value and the user's feeling when there is a discrepancy between the evaluation value and the user's feeling. Also, by setting a new evaluation standard by the user, the evaluation method of the user can be made as close as possible. And
By directly or in some way converting the multiple evaluation criteria created in this way and taking the minimum value, the items that the user feels are most unsuitable are extracted, and the calculation method of the control output is updated using these evaluation criteria. By doing so, it becomes possible to perform harmonious control in view of multiple evaluation criteria.

Regarding the means for reducing the network load at the time of failure diagnosis, each controller sends abnormality information to the input / output filter when a failure occurs, and the input / output filter has already transmitted the abnormality information including the transmitted abnormality information to the network. Whether or not the error information has been sent to the network is judged by referring to the history information stored in each controller, and if the error information including the sent failure information has not already been sent to the network, the error information is sent to the network. As a result, it is possible to prevent redundant abnormality information from being transmitted to the network.

For more autonomous backup,
It is possible to search the task to be backed up and the controller suitable for the backup by which controller's backup request means by the execution sharing table, task load table, and reception order table provided for each controller, and notify the backup acceptance means. become. In addition, the backup acceptance means of the controller requested to back up determines based on its own load of its own execution allocation table whether the backup target task in this notification can be executed, and selectively executes the backup target task. Accept. By broadcasting the result of this selection as a reception message, the requester and other controllers can reflect the change in the load status of the controller that has performed the backup in the execution allocation table and the reception order table. In addition, it is possible to know the backup target task that was not accepted by the requesting controller, and again the acceptance ranking table (at this time, the controller that backed up first is not at the top of the acceptance ranking table because the load factor increases. You can request a new controller for the unaccepted portion.

As described above, in the present invention, each controller always grasps the execution status of the system accurately, and the controller requested to back up can reject the request. Therefore, the task to be backed up is divided autonomously. /
It can be distributed and processed. Furthermore, even when one of the multiple processors included in one controller fails, the internal backup means selects a processor with a small load according to the execution allocation table, and checks whether the load of the failed processor can be backed up to that processor. It is determined that backup is performed so that the processor does not become overloaded, and if there is a remaining load, another processor is selected and backup is performed in the same manner. In this way, the internal backup means divides the load of the failed processor into the load limit of each processor so that each processor does not become overloaded, and backs up one after another by a plurality of processors.

[0035]

Embodiments of the present invention will now be described in detail with reference to the drawings.

FIG. 1 shows a plant control system which is an embodiment of the present invention. The controlled plant 100 includes analog type sensors 111, 115, 119 such as flow meters, analog type actuators 112, 116, 120, such as control valves.
Digital sensors 113, 11 such as limit switches
7, 121 and digital actuators 114, 118, 122 such as solenoid valves. In this example, the sensor 111 and the actuator 112 make up one set, and the sensor 113 and the actuator 114 make up one set, and each constitutes a control target device. Although only one sensor and one actuator are shown in each device to be controlled in this figure, there may be a plurality of them. Controller 1,
2, 3, 4, 5, and 6 are arranged corresponding to each control target device, and they are connected by a network 1000.

The man-machine device 1200 is a device that monitors the operation of the plant and issues a manual operation command to each controller in some cases.

Next, a steel rolling control system, which is one of the specific examples of one embodiment of the present invention, will be described. For reference, a conventional steel rolling control system will be described with reference to FIG. The pay-off reels 151 and 152 are coils of the material to be rolled, and the material 180 to be rolled is passed through the entry side processing line 153 and the looper 154, and rolling mills 155, 156, 157, 1 are provided.
It is rolled at 58 and becomes a final product 181 and is wound on a tension reel 159. The reels, rolling mills, etc. are motors 140, 141, 142, 143, 144, 145.
Driven at 146. Drive devices 130, 131, 132, 133, 134, 13 corresponding to respective motors
Reference numerals 5 and 136 are power circuits for driving the respective motors. Conventionally, drive devices 130, 131, 132, 133, 1
34, 135, and 136 are composed of a power converter 190 and a dedicated high-speed controller 195 for controlling it. Although only the inside of the drive device 130 is shown in FIG. 2, the drive devices 131, 132, 133, 134, 13 are shown.
The same applies to the internal configurations of 5,136. On the other hand, the controllers 1500, 1501, 1502, 1503 have a configuration in which the speed command of each motor is calculated from the target plate thickness, the plate thickness on the inlet side, the tension between stands, etc., and the command value is output to each drive device.

Operation monitoring of this control system is performed by man-machine devices 1200 and 1201. A network 1000 connects the controllers and the man-machine devices.

FIG. 3 shows a steel rolling control system to which the present invention is applied. In this embodiment, each motor drive device 16
1,162,163,164,165,166,167
One-to-one with the controllers 11, 12, 13, 14, 1
5, 16, 17 are allocated. Moreover, each motor drive device 161, 162, 163, 164, 165
166 and 167 are composed of only the power converter 190, and there is no dedicated controller as in the past. As will be described later, the controller of the present invention has a multiprocessor configuration, and the conventional power converter control function is assigned to one processor in the controller.

Although not shown, rolling mills 155,
The control of the roll gap between 156, 157 and 158 is usually controlled by a hydraulic pressure reduction device. This hydraulic pressure reduction device must be controlled at a high speed of several milliseconds,
In the past, a dedicated controller was specially placed.
However, according to the present invention, as in the control of the motor, one processor in the rolling-down instruction calculation controller may be assigned to the control. By adopting such a configuration, as will be described later, an extremely highly reliable and high performance control system can be realized.

FIG. 4 and FIG. 5 show the control of an automobile which is another embodiment of the present invention. FIG. 4 illustrates control items of a general automobile. FIG. 5 shows a control system configuration in the case where the present invention is applied to control of an automobile.

The controller 21 controls the engine 21a. The controller 21 detects the amount of air flowing into the cylinder, the number of revolutions and the angle of rotation of the engine, the angle at which the accelerator pedal is depressed, the temperature of the cooling water of the engine, and the temperature of the catalyst for exhaust gas purification. Depending on these,
The fuel injection amount is manipulated so that the ratio of fuel to air in the cylinder becomes the stoichiometric air-fuel ratio. Then, the ignition timing is operated according to the state quantity. These operations increase the efficiency of the engine and increase the power output. At the same time, it reduces harmful substances in the exhaust. Further, when the temperature of the engine cooling water and the temperature of the exhaust gas purification catalyst are lower than the optimum temperature, the controller 21 slightly advances the ignition timing in order to quickly warm them. When the controller 28 notifies the lighting of the headlight and the operation of the cooling device via the network 1000, the controller 21 slightly opens the throttle to increase the output of the engine in order to prevent the engine from stopping or the vehicle speed from varying.
When the vehicle speed notified by the controller 22 via the network 1000 exceeds a specific value, the controller 21 reduces the fuel injection amount to prevent the vehicle speed from significantly exceeding the specific value. When the controller 22 notifies via the network 1000 that a gear change is in progress, the controller 21 adjusts the output of the engine so that the acceleration changes smoothly before and after the gear change. When the accelerator pedal depression angle suddenly increases, the controller 21 determines that the driver's vehicle requires rapid acceleration. Then, the controller 21 requests the controller 28 to stop the cooling device via the network 1000 in order to use the output of the engine consumed in the cooling device to accelerate the vehicle. At the same time, the controller 22 is requested to shift down.

The controller 22 controls the transmission 22a. The controller 22 detects the vehicle speed and shifts to a gear ratio corresponding to this. At this time, the vehicle speed, which is the reference of the gear shift, is changed according to the throttle opening degree notified by the controller 21 via the network 1000, the rotation speed of the engine, and the vehicle body posture notified by the controller 23. When the throttle opening is small and the engine rotation speed is high, the output loss due to the intake resistance of the engine increases, so the engine speed is reduced by shifting up at a low speed. If the vehicle body is leaning backward, it is determined that the vehicle is climbing a slope, the standard vehicle speed for upshifting is increased, and the low-speed gear is used to maintain the climbing force.

The controller 23 is a suspension 23a
Control. The controller 23 detects the displacement of the suspension and the vehicle body posture, receives the vehicle speed from the controller 22 and the steering angle from the controller 25 via the network 1000, and controls the air pressure in the air spring of the suspension accordingly. Set the desired body posture. This controller 23 notifies other controllers of the vehicle body attitude via the network 1000.

The controller 24 controls the brake 24a. The controller 24 detects the rotation speed of the tire, receives the vehicle speed from the controller 22 via the network 1000, and receives the steering angle from the controller 25, obtains the slip ratio of the tire with respect to the ground according to these, and this value is a predetermined value. Determine the braking force so that Furthermore, when turning, the inner wheel is weakly braked to smoothly turn.

The controller 25 is the power steering 2
5a is controlled. The controller 25 detects the twisting angle of the steering shaft and adjusts the assist torque of the power steering so that the angle becomes smaller. Further, the controller 25 detects the steering angle and notifies the other controllers via the network 1000.

The controller 26 diagnoses the failure. The controller 26 detects a failure or deterioration of another controller or a device to be controlled by comparing the amount of state or the amount of operation notified from another controller via the network 1000 with its own simulation result. When a failure or deterioration is detected, the failure diagnosis result is notified to the controller 28.

The controller 27 is a drive recorder, and stores the history of vehicle operation notified via the network 1000 in a storage device resistant to shock and heat.

The controller 28 controls the man-machine interface such as the switch 28a, the meter 28b and the display 28c. When the driver operates the switch 28a, the controller 28 activates or deactivates the corresponding device according to the on / off state. Further, the state quantities such as the vehicle speed and the engine rotation speed notified via the network 1000 and the result of the failure diagnosis are displayed on the meter 28b or the display 28c. Also, various devices are turned on / off in response to a request or request from another controller via the network 1000.

As described above, each controller notifies each other of the detected state quantity and the control output or the operation request via the network 1000, and each controller is responsible for the notified state quantity, the control output and the operation request. Control the equipment.

One of the features of the present invention is that a plurality of controllers are distributed and arranged corresponding to each control target device as described above.

FIG. 6 shows an example of system configuration when the present invention is applied to a hierarchical system. When the plant is composed of different control target device groups 100, 101, 102 or when the control device groups 100, 101, 102 are distributed over a wide area, etc., the network is changed to the network 1000, as shown in FIG. Controllers 1, 2, 3, etc. are divided under each network by dividing them like 1001, 1002.
Place 4, 5 and 6. Network 1000,100
Reference numerals 1 and 1002 denote integrated controllers 1300 and 130, respectively.
1, 1302 to the upper network 1500. The general man-machine 1600 monitors the operation of this control system.

7 and 8 show the internal structure of the controller described so far. The controller 1 includes a global memory (GM) 52, arithmetic processors (PR1, PR2, PR
3) 54, 56, 58 input / output processing unit (I / O) 53,
Network control processor (NCP) 40, network connector (NetworkConnector) 41, scale expansion connectors (BusConnector) 60, 61, 62, 63, and a connector (I / O Connector) for connection with a device to be controlled
64. In addition, arithmetic processor (PR
1, PR2, PR3) 54, 56, 58 have local memories (LM1, LM2, LM3) 55, 57, 59, respectively.

The NCP 40 is connected to the GM 52,
The contents of the LM 55, 57, 59 and I / O 53 are read, and another controller or man-machine device (12 in FIG. 1) is read.
00) to the data sent from another controller or man-machine device 2000.
2, it has a function to write in LM55,57,59 and I / O53. The bus 72 is a processor 54, 56, 58
Used to access GM52 and I / O53. The bus 71 is a bus for serial data for transmission. By adopting such a configuration, the expandability of the controller can be secured, and even if one processor fails, another processor can perform alternative processing (described later) and all the processors in one controller fail. Also, it is possible to build a system (described later) that can perform alternative processing with other controllers.

FIG. 8 shows the processor (PR1) 5 in FIG.
4 shows the internal configuration of No. 4. In FIG. 7, each processor has the same configuration, and that configuration is referred to as a processor (P
R1) will be described as an example. Processor (PR1)
54 is a general-purpose engine (GE) 6811 that executes a task
And a neural engine (NE) 6812 for accelerating the neuro operation included in the task, and a sequence engine (SE) 6813 for accelerating the operation for sequence control included in the task. When the memory is the global memory (GM) 52, a high-speed transfer is performed between the local memory (LM) 55 and the global memory (GM) 52, and the bus interface (BIF) 6817 that connects the bus 70 and the bus 6819 in the processor. Direct memory access control (DMAC) 681
8, a free-run timer (FRT) 6815 that is a clock for scheduling, and a failure control circuit 6 that detects a failure of each component to stop the operation of the processor and notify the other processor of the failure via the bus 72.
820 inclusive. Furthermore, each component is connected by a bus 6819.

FIG. 9 shows the internal construction of another embodiment of the controller described so far. The difference from FIG. 7 is that the function of the NCP 40 in FIG.
Run adapters (LA) 86, 89 for executing parallel data conversion of serial data or vice versa and encoding / decoding for each processor 84, 87, 90, 93 so that they can be executed by any of 0, 93. 92, 95
Is added. As a result, the transmission function (NCP) substitution processing can be performed similarly to the processor substitution processing.

FIG. 10 shows the processor (PR
1) The internal structure of 84 is shown. The difference from FIG. 8 is that a run adapter (LA) 86 and a connection interface 6902 for the bus 6819 are provided.

FIG. 11 shows the internal structure of still another embodiment. The difference from FIG. 9 is that the local memory 8 in FIG.
That is, the cache memories (CM) 301, 302, 303, 304 are used instead of 5, 88, 91, 94. Cache memory controller (CMC) 40
1, 402, 403, and 404 are cache memories (C
M) Transfer data between 301, 302, 303, 304 and the global memory 400.

FIG. 12 shows the processor (PR
1) The internal structure of 84 is shown. The difference from FIG. 10 is that the direct memory access control (DMAC) 6818 in FIG. 10 is unnecessary in FIG. This is because the cache memory controller (CMC) 401 performs data transfer between the cache memory (CM) 301 and the global memory 400.

FIG. 13 shows the internal structure of still another embodiment. The difference from FIG. 11 is that run adapters 86, 89, 92,
95, network connector 41 and processor 8
The connection of 4,87,90,93 is made programmable by programmable switch arrays (PSW1, PSW2) 8101, 8102. As a result, not only the transmission function can be executed by any of the processors 84, 87, 90 and 93, but also a run adapter (LA) 86 for converting serial data into parallel data or vice versa and encoding / decoding. , 89, 92, and 95, the alternative processing of the transmission function can be performed without switching the processor by switching the run adapter (in the configuration of FIG. 11, it is necessary to switch the processor even if the run adapter fails. ). The internal configuration of the processor in FIG. 13 may be the same as that shown in FIG.

FIG. 14 shows a configuration example of the programmable switch array. Input / output Xi and Yj to the switch array
A MOS transistor Tij is provided at the intersection of the two, and a nonvolatile memory cell Mij is connected to the gate of the MOS transistor Tij. That is, when the output of the memory cell Mij is "1", the MOS transistor Tij
Is turned on and Xi and Yj are connected. On the contrary, when the output of Mij is "0", Tij turns off and Xi and Yj
Is in a disconnected state. The memory cells Mij have address lines A1, A2, A3 and data lines D1, D2, D.
3 is connected, and data is written via this.

FIG. 15 shows an example of the internal circuit of the memory cell Mij. This circuit uses a flash memory as a non-volatile memory element. In the normal operation state, the rewrite mode signal is "LOW", and the NMOS: N1 is OF
F, PMOS: P1 is ON. The potential of the address line is equal to the power supply voltage, for example. Therefore, the potential of the node A becomes "LOW" when the memory element is in the erased state (threshold voltage is low), and the output of the inverter I2 also becomes "0". That is, the MOS connected to this cell
The transistor Tij is turned off. On the contrary, when the memory element is in the written state (high threshold voltage), the potential of the node A becomes "HIGH" and the output of the inverter I2 becomes "1", and the switch MOS transistor Tij is turned on. To write to a memory cell, set the write mode signal to "HIGH", turn on NMOS: N1 and turn PMO on.
S: P1 is turned off. In this state, by applying a high voltage to the address line and the data line, the memory element M1 is in the write state. Erasing the memory element is performed by setting the address line to "LOW" and applying a high voltage to the source of the memory element.

FIG. 16 shows a structure for providing a spare area in the programmable switch array so that a partial failure can be relieved. In this example, the switch array shown in FIG. 14 is provided with failure relief elements: Ts1 to Ts3 and T1s to T.
3s, Ty1 to Ty3, Ms1 to Ms3, M1s to M3s
Is added. Normally, Ts1 ~
Ts3 and T1s to T3s are OFF, Ty1 to Ty3
Is ON, and the same operation as the circuit of FIG. 14 is performed.
Next, the remedy method when a failure is detected is shown below. A case where the memory cell M11 fails will be described. First, the contents of M11 to M13 are transferred to Ms1 to Ms3. Then M
Turn 1s to "1", turn T1s ON and turn Ty1 OFF. As a result, the faulty part is replaced by the spare circuit, and the same operation as before the fault can be performed.

FIG. 17 shows an example of the internal structure of the general-purpose engine shown in FIGS. 8, 10 and 12. This engine is a micro program memory 8202, a reading circuit
8203, microinstruction register 8204, and decoder 82
05, a register, an arithmetic unit 8206, a multiplexer 8208, and an address decoder 8207. At the beginning of activation, the address decoder 8207 is cleared, and the instruction at address 0 of the microprogram memory 8202 is interpreted and executed by the decoder 8205. The micro instruction indicates the address of the next instruction to be executed (8
207). In this way, the micro program memory 8
The microinstructions written in 202 are sequentially executed.

The micro program memory 8202 is composed of, for example, a non-volatile memory such as a flash memory, and the function of the processor can be changed to a desired one by rewriting this micro program. For this rewriting, the micro program memory 82
02 has a built-in rewrite circuit 8201 for exclusive use, and by setting a rewrite mode by a rewrite mode signal 8302, rewriting is performed according to the address and data supplied from the rewriting address bus 8301 and the data bus 8300.

FIG. 18 shows, as another embodiment, an example in which each processor is configured by combining a plurality of processor elements (PE). Each processor is configured by combining a required number of processor elements according to the purpose of each processor. By doing so, the entire LSI can be configured with the same processor element, and the LSI can be easily implemented and a controller with less waste can be configured.

Next, the input / output unit will be described in detail.

As described above, the types and points of the sensors and actuators connected to each controller differ depending on the control target. Therefore, conventionally, it was necessary to select an input / output device corresponding to them from the repertoire and connect it to the controller. On the other hand, in the present invention, one purpose is to construct a control system using as few kinds of hardware as possible, so the following input / output configuration is adopted.

FIG. 19 shows the internal structure of the I / O 83 in FIG. The I / O 83 is a bus interface 830, D
/ A converter 832, analog output composed of OP amplifier 833, analog input composed of OP amplifier 835, A / D converter 834, register 836, digital output composed of power circuit 837 and digital input composed of power circuit 838, and these It is composed of a power switch array 840 that determines the coupling with the I / O connector 64.

The power switch array 840 is programmed from the interface circuit 830 through the signal line 850. The configuration of the power switch array 840 is shown in FIG.
Although it is the same as the one shown in, the physical capacity must be increased to handle the power.

FIG. 20 is a block diagram showing the I / O 83 realized by a one-chip semiconductor. The semiconductor is roughly composed of two layers, and the upper semiconductor 980 includes a power circuit section 902, a power switch array section 901, and a process connection terminal 900, and the lower semiconductor 950 includes an OP amplifier section 951 and D / A.
Conversion unit 952, A / D conversion unit 953, register unit 954,
It is composed of a bus interface 955 and a connection terminal 960 for connecting to the bus interface (FIG. 21 shows the lower semiconductor 950). Also, the upper semiconductor 9
Wiring between 80 and the lower semiconductor 950 is performed by a wiring layer 970.

22 and 23 are block diagrams in which the controller 1'in FIG. 9 is realized by a one-chip semiconductor.
The semiconductor is roughly composed of two layers, and the upper semiconductor 980 has the same structure as in FIG. 20, but the lower semiconductor 950 has an OP amplifier 951, a D / A converter 952, and an A / D converter 95.
3, a memory group 956 and a processor group 957 other than the register section 954 are included (FIG. 23 shows the lower semiconductor 950). Also, the upper semiconductor 9
Wiring between 80 and the lower semiconductor 950 is performed by a wiring layer 970.

Although the internal structure of the controller has been described with reference to the embodiments, the scope of the present invention is not limited to the scope of the embodiments and various modifications can be made. For example, as the nonvolatile memory for the function program, other than the flash memory, electrically rewritable EEPRO is used.
It may be M or a ferroelectric RAM, or a battery-backed SRAM.

Next, FIG. 24 shows the appearance of the controller of the present invention. I / O connectors 64 are provided on the front surface of the controller, and left and right side surfaces and upper and lower surfaces are provided with scale expansion connectors 60, 61,
62 and 63 are mounted. A network connector 1701 and a power connector 1702 are provided on the back surface 1700.
Has been implemented. The external dimensions are about 20 cm in height, about 10 cm in depth, and about 3 cm in width, which is sufficient for connecting input and output and for distributed installation. This dimension is for reference only to show how small the present invention can be, and the present invention is not limited to this dimension.

FIG. 25 shows two controllers connected to each other using the scale expansion connectors 60 and 61.

FIG. 26 shows a case in which two controllers are connected using the scale expansion connectors 62 and 63.

In FIG. 27, four controllers are connected using the scale expansion connectors 60, 61, 62, 63.

As described above, by having the bus structure and the external structure of this embodiment, the controller scale can be easily expanded.

Next, the control calculation method used in the present invention will be described.

FIG. 28 shows a basic block diagram of a control arithmetic unit for performing a control arithmetic operation based on input data from a sensor or the like.
In the present invention, the input data 2001 is input to a plurality of output generation means, here, the neural network 2101, the fuzzy inference means 2102 and the PID control means 2103. Then, in the weighting unit 2021, the output value of each output generation means is assigned a corresponding weight value K.
_The output data synthesizing unit 202 is weighted with ₁ , K ₂ , and K _3.
Output data weighted by 2 is added to output data 200
Get 2. At this time, if the weight values K ₁ , K ₂ and K ₃ are added so as to be 1, the output data synthesizing unit 202
At 2, we simply need to add the weighted outputs. Here, since the three means of the neural network 2101, the fuzzy inference means 2102, and the PID control means 2103 can be respectively executed in parallel, they are executed by different processors (for example, in the case of the controller of FIG. 7, the processors 54, 56). , 58 are in charge of three kinds of operations)
As a result, the control calculation can be executed without reducing the processing speed.

FIG. 29 shows an overall schematic diagram of the embodiment. Here, a control method that includes an output calculation unit 2012 and an output evaluation unit 2015, and the output calculation unit 2012 and the evaluation unit 2015 have a learning model and an assignment model, respectively, and adaptively cooperate the two will be described. Input data 2300 obtained by input processing the data 2001 from the sensor 2010 or the like in the input processing unit 2011 as necessary is input to the output calculation unit 2012 and the evaluation unit 2015. The output calculation unit 2012 receives the input data 2300, calculates the output data 2301 using the parameters and the like inside the input data 2300, performs the necessary output processing in the output processing unit 2013 as necessary, and then outputs the value. 2002 is output to the actuator 2014. Here, the parameters and the like include weight values of connections between neurons in a neural net that is a learning model, parameters in the imparting model, and parameters for weighting the learning model and the imparting model. On the other hand, the evaluation unit 201
In No. 5, the current state is evaluated using the input data 2300 and internal parameters, and the output evaluation signal 2302 is output from the result. Then, the output calculation unit 2012 uses the output evaluation signal 2302 to learn internal parameters and the like so that this value becomes large. On the other hand, regarding the parameters in the evaluation unit 2015,
For example, the state evaluation signal 2303 is sent to the man-machine device 1200.
Is displayed, and when the user sees this and feels inappropriate, a pointing device 201 such as a touch panel or a mouse is displayed.
Enter the correction value using 7. This is the external evaluation signal 23
04 is input to the evaluation unit 2015, and at this time, the external evaluation valid signal 2305 is turned on to update the parameters and the like in the evaluation unit 2015 so that the learning can be performed so that the evaluation adapted to various situations can be performed.

The configuration of the output calculation unit 2012 is shown in FIG. In the learning of the output calculation unit 2012, since there is no direct teacher signal like the external evaluation signal 2304 in the case of the evaluation unit 2015, a random number component is added to each parameter and the random number component is added based on the evaluation value at that time. Evaluate and make corrections. Therefore, the output calculation method is as follows. First, using the input data 2300 and the learning model parameters obtained from the learning model parameter holding unit 2421, the learning model calculation unit 2401 calculates the output, and the input data 2 according to the addition model given in advance by the user.
300 and the added model parameter obtained from the added model parameter holding unit 2411, to which a minute random number is added by the random number adding unit 2412 is used as a parameter,
The output of the addition model calculation unit 2402 is obtained. Then, the weighting unit 2403 weights the respective output values and adds them to obtain output data 2301. However, the output from the learning model calculation unit 2401 is the random number addition unit 2422.
The weighting is applied to the one to which a minute random number is added. Further, the weight value used in the weighting unit 2403 is also weighted by actually using the weight value held in the weight value holding unit 2431 to which a random number is added by the random number adding unit 2432. First, regarding the weight value of the weighting unit 2403, the random number 2433 added by the random number adding unit 2432 and the output evaluation signal 2302 obtained from the evaluation unit 2015 are multiplied in the weight value update amount calculation unit 2434, for example, and the weight value holding unit The value is passed to 2431, and a new weight value is added to the original weight value. On the other hand, regarding the parameters in the learning model calculation unit 2401, the output error calculation unit 2424 multiplies the random number 2423 added by the random number addition unit 2422 and the output evaluation signal 2302 from the evaluation unit 2015, for example, to calculate the learning model. Part 24
The learning model calculation unit 2401 calculates the update amount for the parameter such as the weight value of the internal neural network based on the value as the error to be given to 01, and the new value as the learning model parameter. Write to the holding unit 2421. In addition, in the addition model calculation unit 2402, in the addition model parameter update amount calculation unit 2414, the random number 2413 added by the random number addition unit 2412 is also multiplied by the output evaluation signal 2302 from the evaluation unit 2015, for example, and the value is added. The value of the new added model parameter is written to the model parameter holding unit 2411.

On the other hand, FIG. 31 shows the configuration of the evaluation unit 2015. Here, first, the learning model calculation unit 2501 obtains an output by using the learning model parameters such as the weight value of the connection of the neural network obtained from the input data 2300 and the learning model parameter holding unit 2521. Further, in parallel with this, according to the model previously given by the user, using the input data 2300 and the addition model parameter obtained from the addition model parameter holding unit 2511,
The applied model calculation unit 2502 also calculates the output.
Then, the weighting section 2503 weights the respective output values on the basis of the weight values held in the weight value holding section 2531 and adds them together, and the time differentiation calculation section 2505 differentiates the added results by time. An output evaluation signal 2302 is generated. The learning in the evaluation unit 2015 is performed based on the signal from the external evaluation signal 2304 when the external evaluation valid signal 2305 is on. For example, the outputs of the learning model calculation unit 2501 and the addition model calculation unit 2502 are compared, and the weighting parameter closer to the external evaluation signal 2304 is increased and the other parameter is decreased. Further, the learning model calculation unit 2501 is given learning by applying the external evaluation signal 2304 as a teacher signal. On the other hand, in the addition model calculation unit 2502, in addition to the normal output value, a minute random number is given to the parameter to obtain another output value, the two are compared, and the random number is added to the external evaluation signal 2304. For example, add the product of the added random number and learning constant to the parameter,
If it is better not to add random numbers, learning can be performed by subtracting the random number added from the parameter and the learning constant. Further, the imparting model does not need to have a learning function, and the evaluation unit 2015 does not have to include the imparting model calculating unit and the learning model calculating unit. When both the learning model calculating unit 2501 and the imparting model calculating unit 2502 are provided, weighting of both outputs in the initial state is performed by setting the imparting model side to 1 and the learning model side to 0, before starting learning. It is possible to prevent the output of the learning model from affecting.

Next, an embodiment in the case of having a plurality of evaluation criteria will be shown. The overall configuration diagram is shown in FIG. Here, a first evaluation unit 2601 and a second evaluation unit 26 are provided as a plurality of evaluation units.
It is assumed that there is 02. The parameters in each evaluation unit are modified by the man-machine device 12 as in the case of one evaluation unit.
00 to the state evaluation value 2603 of the first evaluation unit 2601 and the second
The state evaluation value 2604 of the evaluation unit 2602 is displayed, and the state evaluation value 2604 is displayed on the pointing device 20 such as a touch panel or a mouse.
17 is used for correction, and when corrected, 1 is set to the corresponding external evaluation valid signal 2605. Then, the correction value at that time is transferred to each evaluation unit as an external evaluation signal 2606. Then, in the corresponding evaluation unit, the internal parameters may be modified. Moreover, although a plurality of output evaluation signals can be obtained, for example, it is conceivable that the minimum value of the plurality of output evaluation signals is selected and given to the output calculation unit 2012. Then, the parameters and the like in the output calculation unit 2012 can be updated so that the evaluation standard that the user feels most unsuitable can be improved.

Next, FIG. 33 shows a case where the weight value for weighting the outputs by a plurality of means and methods is changed by the input data 2001. Here, input data 2001
Is input to the neural network 2701, a random number component is added to the output that has been output by the random number addition unit 2702,
Based on the value K, the weighting unit 2021 weights the outputs of the neural network 2101 and the output generation unit 2102, adds the data weighted by the output data synthesizing unit 2022, and generates output data 2002. On the other hand, in the teacher signal generation unit 2703, the random number component is multiplied by the output evaluation signal 2302, and the result is added to the output of the neural network 2701 and passed to the neural network 2701 as a teacher signal for learning. However, at this time, the output of the neural network 2701 may be set to a value close to 0 before the learning is started, and the output of the output generation means 2 (2102) may be the output data 2002.

Embodiments relating to the method for reducing the network communication load of the present invention will be described in detail below with reference to the drawings. FIG. 34 shows the configuration of the distributed control system to which the present invention is applied, in which a plurality of controllers (1, 2, 3, ...) Are controlled by the network 1000. The control information and diagnostic information of the entire system are processed and displayed on the man-machine device 1200. Since each controller executes not only control but also diagnosis processing, the communication interface 4012 for transmitting the diagnosis processing unit 4010, the control execution unit 4011 and the control information and the diagnosis information to another controller via the network. I have

In such a distributed control system, when a common mode failure occurs, a large amount of abnormal information from each distributed control sensor may be transmitted to the network, resulting in communication failure.

For example, consider a case where each controller has a constraint condition, the diagnostic processing unit checks the constraint, and if the constraint is not satisfied, a constraint expression that does not satisfy the constraint is transmitted to the network. In such a case, the abnormality diagnosis is to identify which of the constraint variables of the constraint equations that are not satisfied causes the constraint not to be satisfied.

FIG. 35 shows an input variable, an output variable, and a constraint equation of each controller of the distributed control system consisting of four controllers as a concrete example for the following description. For example, the controller 1 uses X as an input variable.
1 and X2, X3 as an output variable, and C1: E (X3, X1 + X2, e1) as a constraint expression. Here, E is an error relational expression and represents that the difference between the absolute values of the first variable and the second variable is equal to or less than the third variable. In this example, it is shown that X1 + X2-e1 <X3 <X1 + X2 + e1.

The state quantities of the target plant are X1 = 1, X2 =
2, X4 = 2. When the controller controls each state quantity, each checks the constraints shown in FIG. 35, and if the constraints are not satisfied, it sends information to the network. At this time, if the controller 1 is operating normally, X3 = the value of X3 that satisfies the constraint condition C1 from the values of the input variables X1 and X2 =
3 is determined and output. However, suppose that the controller 1 fails for some reason and outputs X3 = 13. At this time, in the controller 2, the constraint condition C2,
Inputs X3 and X4 output X5 = 15 and constraint condition C3 and input X3 output X6 = 13. However, since constraint condition C4 is not satisfied, an abnormality indicating that constraint condition C4 is unsatisfied is transmitted. In the controller 3, inputs X3 and X5
Then, according to the constraint condition C5, the output X7 = 195, but since this does not satisfy the constraint condition C6, the controller 3 transmits an abnormality that the constraint condition C6 is not satisfied.
In the controller 4, X9 = 15 is output from the input variables X3, X5 and X6 and the constraint condition C7, and the constraint condition C8 is output.
Therefore, X8 = 26 is output, which is the constraint condition C
9 is not satisfied, the controller 4 transmits abnormality information that the constraint condition C9 is not satisfied. As described above, in the distributed control system, since one controller fails, abnormality information may be output from many other controllers, a communication neck may occur, and diagnosis may be hindered.

In order to solve such a problem, the present invention employs a method of filtering information input / output from / to each controller to the network. In addition, as information to be transmitted when an abnormality occurs, two data frames are prepared, one for each controller to send to the man-machine device for executing filtering, and one for each controller to sequentially send via the network. Higher-speed processing is possible by preparing a network in which the controllers are connected in a ring shape and two types of networks that connect the controllers and the man-machine device in accordance with this. Here, as one embodiment, both the man-machine device and each controller are connected by one network, and the destination of the abnormality information when an abnormality occurs is included in the abnormality information.

FIG. 36 shows the configuration of the communication interface of each controller. The input information filter section 4030 is for filtering unnecessary input information by the 4030 and the necessary information is taken into the controller, and 4031 is the unnecessary output. An output information filter 4032 for sieving information and not transmitting unnecessary output information to the network is a communication processing unit for decompressing encrypted and information-compressed information. These processes are executed by the NCP 40 in the controller shown in FIG. 7 and by the run adapters 86, 89, 92, 95 in the controllers shown in FIGS.

Here, a method using a constraint variable set will be described as an example of sieving unnecessary output information.
Here, the constraint variable set refers to all variables defined in the constraint equation. For example, if the constraint variable set of the constraint condition C1 in FIG. 35 is V (C1), V (C1) = {X1,
X2, X3}. Since the error variable e1 is artificially introduced to indicate the error range, it is not included in the constraint variable set.

Based on the inclusion relation of this constraint variable set,
The abnormality detected by each distributed control system is passed through the network to another individual controller and the man-machine device 1200.
Decide whether to send to. However, since this information alone is not sufficient, information on input / output variables in each distributed control system is also used. That is, when transmitting the abnormality information to the network, as shown in FIG. 37, in addition to the constraint variable set, the input variable set, the expansion variable set, the deletion variable set, the abnormality information data ID, and the device ID information are also added. To do. Here, the input variable is an input variable in each controller in which an abnormality has occurred. If the input variable in the controller 1 is In (1), In (1) = {X
1, X2}. The expansion variable and the elimination variable are information added when narrowing down the abnormal variable when the abnormal information is received from another controller, and will be described in detail later. The abnormal data ID is information for indicating when this data frame is data of a type called abnormal data and is transmitted, and here, AB_92_07_03_10_24_.
It is assumed to be 10. AB indicates that the information is abnormal, and the subsequent numbers indicate that the abnormal information is transmitted at 10:24:10 on July 3, 1992. The transmission destination ID indicates whether the abnormal data is for the man-machine device or is addressed to each controller. For example, if it is for a man-machine device, 0 is described here, if it is addressed to each controller, here, and the device ID describes the ID of the controller that issued this abnormality information. In this data field, since it is transmitted from the controller 1, 1 is entered here.

When such abnormal information is transmitted to the network, each controller determines whether or not the information is related to itself by the input information filter, and if it is related information, takes it in. On the other hand, only the abnormal data ID, the constraint variable set, the device ID and the input variable set in the abnormal information data format are immediately sent to the man-machine device without being processed.

In the following description, using the present example, first, it is shown how unnecessary abnormal information is suppressed from being transmitted to the network, and then, how the abnormal point is detected. Will be identified.

First, processing for suppressing unnecessary information is shown in FIGS. 38 and 39. FIG. 38 shows an outline of the process. By referring to the abnormality information registered in the man-machine device, it is determined whether the abnormality information to be newly transmitted is included in the already transmitted information. Judge, and if included, stop transmission. FIG. 39 shows the process of determining the inclusion relation between the abnormal information. First, it is checked whether or not there is an inclusion relation between the constraint sets. If there is no inclusion relation, there is an input / output relation between the controllers. Considering this input / output relationship, the inclusion relationship may be established in some cases, and this determination is also performed. These processes will be shown by a concrete example.

First, consider the case where the above-mentioned abnormality information is transmitted from the controller 1 as two data frames, one for the man-machine device and the other for each controller, and already received by the man-machine device. As described above, the other controllers 2, 3 and 4 also detect the constraint violation and try to transmit the abnormality information. For example, the controller 2 does not satisfy the constraint condition C4. The constraint variable set of this abnormality information is V (C4) = {X5},
The input variable set is {X3, X4}. Before transmitting this information, the output information filter section of the communication interface of the controller 2 refers to the abnormality information of the man-machine device and has a constraint variable set including the constraint variable set of the abnormality information that the user is trying to transmit. Check if the abnormal information has already been sent. In this case, V (C) of the constraint variable set of the abnormality information transmitted from the controller 1
1) = {X1, X2, X3} does not include V (C4). However, the result will be different if the input / output relationship is taken into consideration. That is, the input variable X3 of the controller 2 is the constraint variable set V of the abnormality information transmitted from the controller 1.
Since it belongs to (C1), the output variable X5, X6 of the controller 2 may be abnormal due to the influence of the input variable X3.

On the other hand, since the input variable of the abnormality information of the controller 1 is {X1, X2}, the cause of the abnormality related to the output variable X5 of the controller 2 is the input of the controller 1 via the output variable X3 of the controller 1. Variable X1,
It may be X2. That is, for the controller 2, in addition to V (C1) = {X1, X2, X3}, Op (C1, 2) = {X5, X6} is also a constraint variable. Here, Op (C1, 2) is a virtual constraint variable of the constraint condition C1 for the controller 2, and is referred to as an expansion variable set here. So V (C1) U _Op (C
1,2) includes V (C4), the constraint condition C
The unsatisfied number 4 is information included in the already-transmitted information about the unsatisfied condition C1. In order to prevent the data from overflowing the network, the output information filter section sifts it and does not allow it to be transmitted. I will.

Similarly, since the constraint condition C6 is not satisfied in the controller 3 as well, the controller 3 tries to send it to the network. However, since the abnormality information has already been transmitted from the controller 1 to the man-machine device, the output information filter of the controller 3 determines whether or not the abnormality information that the user has is worthy of transmission. At this time, as in the controller 2, Op (C1,
3) is obtained, the controller 3 has the output variable X3 of the controller 1 as an input variable, and therefore the output variable X7 of the controller 3 is also a virtual constraint variable.
p (C1,3) = {X7}, and V (C1) U _Op (C
Since V (C6) is included in 1, 3), the abnormality information regarding the constraint condition C6 is not transmitted. Further, also for the controller 4, Op (C1,4) = {X8, X9}, and V (C1) U _Op (C1,4) includes V (C9). Therefore, the abnormality information because the constraint condition C9 is not satisfied is not transmitted. In this way, it is possible to suppress the occurrence of duplicate abnormality information.

Next, using the already transmitted abnormality information,
A method of narrowing down the abnormality information will be described with reference to FIG. When the abnormality information is transmitted from a certain controller, the data is divided into one that goes directly to the man-machine device and one that is broadcast to each controller. The abnormality information is narrowed down to the abnormality information broadcast to each controller. First, each controller determines whether the information on the network is related to itself.

First, the abnormality information on the data bus is fetched into the communication interface of the controller, and the fetched abnormality information is deleted from the network. In the communication interface, first in the communication processing unit, the data is converted from the compressed state to the processable state, then it is determined whether or not the input variable in the abnormality information data has the output variable, and if so, The input variables of the controller are added to the error information as expansion variables. In this example, controller 1
The input variable set of the abnormality information generated from is X1 and X2, and since the controller 2 does not have these as output variables, it is No. Next, it is determined whether or not there is a constraint condition in the constraint variable set included in the constraint variable set included in the constraint set of the abnormality information. Since this is also No, the abnormality information is processed in the network without processing the abnormality information. Is returned. In other words, it is filtered by the input filter and nothing is done. In the present example, the other controller does not perform any processing in the same manner, and the constraint C transmitted first is transmitted.
The anomaly information of 1 is passed through the network with the original form. On the other hand, as described above, in this case, other constraint violations are applied to the filter of the output information and are not transmitted. Therefore, even if there is no narrowing down, it is necessary to specify that the cause is the controller 1 from the beginning. You can On the other hand, it is assumed that, for some reason, for example, the abnormal information about the violation of the constraint condition of C6 of the controller 3 is transmitted before the controller 1. The constraint variable set of this abnormality information is V (C6) = {X7}, and the input variable set In
(3) = {X3, X5}. When this abnormal information comes to the controller 1, the input variable X3 is set to the controller 1
Has output variables (such variables are referred to as common variables), the controller input variables X1, X2, and are added to the expansion variables. In the next judgment, the abnormal information constraint variable set {X7} and the expansion variable set {X1, X2, X3}
Is the constraint variable set {X1, X2,
X3} is included, the abnormality information is processed according to the processing procedure of FIG. 41. At this time, the constraint condition C1 is said to be included in the constraint condition C6. First, it is determined whether the constraint condition C1 included in the received constraint condition is satisfied.
In this case, since it is not satisfied, the constraint condition C1
Checks if it is being sent. If C1 was sent first, C6 will not be sent by the process already described, but if C6 was sent first, C1 could be sent. If C1 has already been transmitted, the received abnormality information is erased, and if it has not been transmitted yet, the abnormality information is rewritten to that relating to C1. In either case, only the constraint condition regarding C1 survives on the network. this is,
From a different point of view, it indicates that the cause of the abnormality has been narrowed down to the controller 1.

To cut unnecessary information transmission and narrow down the cause of abnormality as described above, install knowledge about the inclusion relation of abnormality information in the input / output filter part of each controller and the man-machine device. Can be realized by

For example, knowledge that represents the inclusion relationship of constraints by a tree as shown in FIG. 42 is prepared, and instead of the constraint variable set on the abnormal data format of FIG. 37, the unsatisfied constraint name is described. In this case, if the constraint expression name of the abnormality information already registered in the man-machine device is used instead of the processing of FIG. 39 and the already registered abnormality information includes the abnormality information to be transmitted. By adding only the abnormality information of the integrated monitoring device without transmitting the abnormality information to another controller, it is possible to suppress the transmission of unnecessary abnormality information.

Furthermore, another embodiment of the distributed control system of the present invention for improving reliability and fault tolerance will be shown. The present invention makes it possible for an operating controller to autonomously distribute and back up loads even when multiple controllers in the distributed control system are down. A means for realizing this backup is shown in FIG. FIG. 43 is an embodiment of the present invention in which the controller in operation autonomously distributes and backs up the load against multiple down of the controller of the distributed control system. The controllers 1, 2, 3, 4 connected to and controlling the sensors and control targets of the plant 100 are the network 100.
0 constitutes a distributed control system mutually connected. The controllers 1, 2, 3, 4 are communication means 6 respectively.
110, 6210, 6310, 6410 and backup request means 6120, 6220, 6320, 6420
And backup acceptance means 6130, 6230, 633
0,6430 and schedulers 6140,6240,6
340, 6440 and control means 6150, 6250, 6
350, 6450 and storage means 6160, 6260, 6
360, 6460 and further internal backup means 6
Each controller including the 170, 6270, 6370, 6470 and the disconnecting means 6180, 6280, 6380, 6480 has the same configuration, so the controller 1
Will be described as a typical example. Each controller has four processors as shown in FIG. 47 described later. Furthermore, each processor is a communication means shown here,
It has sufficient hardware to provide the backup requesting means, backup accepting means, internal backup means, disconnecting means, scheduler, and control means, and is sufficient to execute the software (task) that provides each means. Has processing power. Therefore, the above means can be implemented on any processor. The function of each means will be described below.

The communication means 6110 is the network 100.
0, backup request means 6120, backup acceptance means 6130, scheduler 6140, control means 615
0, storage means 6160, internal backup means 617
0, connected to the disconnecting means 6180, for exchanging messages with other controllers, and for exchanging messages or data between other means in the controller and other controllers. Scheduler 614
0 defines and instructs the order and time interval for allocating a plurality of tasks registered in itself to the processor. The control means 6150 controls the sensors and controlled objects of the plant 100. Scheduler 6
140 and the control means 6150 are connected to the storage means 6160, and based on the tasks and data and scheduling information stored therein, the scheduling and the plan 1
Controls 00. Further, the scheduler 6140 and the control means 6150 are connected to the communication means 6110, and the communication means 6110 is used to synchronize with another controller.
And exchange messages with other controllers via network 1000. In this embodiment, the distributed control is performed as described above.

Means for controlling backup will be described.

The disconnecting means 6180 is connected to the internal backup means 6170 and the communication means 6110. This means detects a failure such as a hardware failure in the controller or a software runaway, and stops the operation of the down processor. In addition, the same operation is performed when another controller notifies the failure of the controller including itself through the network 1000. The disconnecting means 6180 is connected to the communication means 6110 so that the backup can be started by notification of a failure from another controller. Furthermore, the internal backup means 6170 is notified through the connection whether the processor is down, either when the failure is detected by itself or when the failure is notified.

In addition to the above functions, the scheduler 6140 described above measures the execution time per unit time for each task executed by the processor inside the controller, and calculates the ratio of that value to the unit time for each task. The load factor of The task load table described later is updated with this value.
Then, when the sum of these load factors exceeds a limit load factor described later, it is predicted that overload will occur in the processor. Further, the load over is detected by determining whether or not the sum of the load factors of the respective tasks exceeds 100% in the processor. If it exceeds, the load is over. The internal backup unit 6170 is informed of the processor predicted to have an overload or the processor having an overload.

The internal backup means 6170 includes a communication means 6110, a storage means 6160, a disconnection means 6180,
Scheduler 6140 and backup request means 6120
It is connected to the. This means is a detaching means 6180.
When the internal down of the controller is notified from, or when the scheduler 6140 is notified of occurrence of overload of the controller or prediction of overload, the task that cannot be executed due to down or overload is executed according to the procedure of FIG. Backup is performed in the controller according to the priority. In order to prevent a partial down or overload leading to down of the whole controller, the tasks that are indispensable for the management operation of the controller are given the highest priority. In order to prevent the communication bottleneck of the network 1000 from becoming apparent and frequent communication delay or failure, a task requiring a large amount of communication when backed up by another controller is given priority next. Backups are carried out in order from the processor with the lightest load, and as long as there are tasks to be backed up, they will be executed with the processors with the heavy load one after another. If there are no tasks to be backed up on the way, the process ends there. If the tasks to be backed up remain even after the backup is performed on all the processors, the backup request means 6120 is notified of this situation, and the procedure concerning the backup between the controllers of FIG. 45 is executed, and this means is executed. To finish. The procedure of FIG. 44 is called an internal backup procedure, and details thereof will be described later by a specific example. Here, an outline thereof will be described to explain the function of this means.

First, the present means performs the steps 6510 to 65.
At 15, the processor responsible for backing up a task that cannot be executed due to a down or overload is determined from within the controller. In this determination, the information on the execution state of each processor stored in the storage unit 6160 is used. That is, a processor with a low load or a processor with a large surplus performance is determined to back up many tasks. Note that these pieces of information are stored in a table called an execution sharing table shown in FIG. Further, it determines the tasks to be backed up among the tasks that cannot be executed due to down or overload. This decision uses information about task attributes and excludes tasks that do not need to be backed up by other processors. Information on the task attributes is stored in a table called a task load table shown in FIG.

Subsequently, this means performs steps 6520 to 6
At 540, the tasks to be backed up add the plurality of tasks that the part in charge of backup was executing before the backup. Then, from among these, the processor in charge of the backup selects a task to be executed after the backup according to the priority. At this time, in order to prevent partial down or overload from causing down of the entire controller, the communication means 611 is used.
0, backup request means 6120, scheduler 61
Tasks that are indispensable for management operation of the controller, such as tasks that provide 40, are selected with the highest priority. In order to prevent the communication volume bottleneck of the network 1000 from becoming apparent and causing a communication failure, a task requiring a large amount of communication when backed up by another controller is selected next with priority. . Then select other tasks. In each priority, the task of the combination that has the maximum load is selected within the range in which the load of the processor in charge of backup does not exceed the limit value. The limit value of this load is stored in the storage means 6160 and is called the limit load factor. In this selection, the load factor of each task stored in the storage unit 6160, the priority in this selection, and the information about the original domicile of the task are used. The task load factor is the processing time required per unit time when the focused task is executed by the relevant processor, and is the value measured when it is executed by a processor having the same processing capacity or the relevant part in advance. is there. If the measurement cannot be made for some reason, the value estimated and set in advance is used.
The original name of a task indicates the controller to which each task originally belongs or a part thereof. Note that these pieces of information are shown in FIG.
It is stored in a table called a task load table shown in FIG. Further, in this selection, even if the processor in charge of backup has executed the task before the backup, it may not be executed after the backup if the priority is low. The task evicted in this way is added to the task to be backed up and waits for being backed up by another processor.

Subsequently, this means registers the selected task in the scheduler 6140 in step 6550, and executes the executing means 6
Start execution at 150. The task ejected from the processor in charge of backup is the scheduler 61
Delete from 40 and stop its execution.

Subsequently, the present means is from step 6560 to step 6.
At 590, the status of the task to be backed up,
Three types of processing are executed depending on the presence / absence of a processor that is not in charge of backup in the controller. First, if the task to be backed up has a high priority task and you have not performed the above procedure that makes all the active processors in the controller responsible for backup, then the next lowest load factor. The processor is selected as the processor in charge of backup, and the internal backup procedure is repeated from procedure 6520 again. In order to back up many tasks or many loads in the controller, we have made this repetition by having each processor in the controller take charge of backup in order. On the other hand, if there are only low priority tasks to be backed up, and some tasks to be backed up have high priority tasks, the above procedure in which all active processors in the controller are responsible for backup In the case of executing the above, the backup request means 612 is provided to broadcast the new execution status of the controller through the network 1000 and to backup the task to be backed up between the controllers.
0 indicates that there is a task to be backed up via the connection, the procedure for backup between controllers in FIG. 45 is started, and the processing of this means ends. Further, on the other hand, when there is no task to be backed up, the new execution status of the controller is broadcast through the network 1000, and the processing of this means ends.

The backup request means 6120 is a communication means 6110, a storage means 6160 and an internal backup means 6.
170 is connected to. When the internal backup unit 6170 notifies that the task to be backed up remains, this unit follows the procedure of FIG. Select and request backup. This selection and request are repeated until the backup of all tasks is completed. This procedure will be referred to as a backup request procedure, and the details thereof will be described later by a specific example. Here, an outline thereof will be described to explain the function of this means.

This procedure is executed by the storage means 6 in step 6610.
Using the information on the load states of all the processors stored in 160, the controller or its processor for which the backup is requested is selected. The selection criterion is that it has the least load among the processors of other controllers. Note that this information is stored in the external reception order table shown in FIG.

Subsequently, this means performs steps 6620 to 6
At 640, a message 6600 indicating that the backup is requested is sent to the request destination selected earlier. This message 6600 contains information on the tasks to be backed up. Message 6600 is sent via network 1000. Then, it waits for a response from the request destination. The response is a message 6700 that is broadcast to the entire system by the requestee and indicates that it is a response to the backup request. Message 67
00 further includes information indicating a task backed up by the request destination and a task that has not been executed by the request destination due to this backup (a task that has been ejected). This means is in the waiting state until receiving this message 6700, and when receiving this message, the waiting state is released and the process proceeds to the next step 6642.

Subsequently, this means executes steps 6642 to 664.
At 8, the procedure determines whether or not there is a task backed up by the request destination, and if there is a task backed up by the request destination, the procedure for determining the end of the backup request (step 6650).
To step 6670). If there is no task backed up by the requestee, it is further determined in step 6644 whether or not all processors of other controllers have been requested for backup. If you have not requested backup of all the processors of other controllers, proceed to step 6.
At 646, among the processors of the other controllers, the one having the smallest load next to the request destination of this time is designated as the next backup request destination, and the process returns to step 6620 to repeat the backup request. If all the processors of other controllers are requested to perform backup, the backup has failed. Therefore, in this case, the procedure 664
As shown in 8, the degenerate operation means is caused to start the degenerate operation,
This means ends the backup request procedure.

If there is a task backed up by the requestee in the judgment of step 6642, then this means stores it in the storage means 6160 in steps 6660 to 6670 according to the message 6700 from the requestee. Modify each of the listed tables. Furthermore, delete the task backed up by the requestee from the tasks that should be backed up,
Add the task evicted from the requestee to the tasks that should be backed up. After that, the presence / absence of a task to be backed up is determined, and when there is a task to be backed up, the procedure returns to step 6610 and the request destination selection and the backup request are repeated. By repeating this request and rejecting or accepting the request, the tasks to be backed up can be autonomously distributed and backed up. The backup acceptance unit 6130 is the communication unit 61.
10 and the storage means 6160. This means uses a message 66 requesting a backup sent from another controller via the network 1000.
When 00 is received, the task requested to be backed up by the message 6600 is backed up according to the load state of the processor requested to back up according to the procedure of FIG. In this procedure, the task requested for backup and the task executed by that processor are also exchanged so that the load factor of the processor in charge of the backup is as large as possible within the limit load factor. This replacement is a necessary function for backing up tasks with a fairly large load factor.
Even if there is no room to back up a task with a large load factor, it is often possible to back up a task with a large load factor by ejecting a task with a small load factor and creating a margin. The expelled task will be requested to be backed up to another processor and executed there as a task to be backed up. Alternatively, replacement may occur there, but each replacement replaces a task with a smaller load factor, increasing the possibility of backup and eventually backup. In this replacement, if a task that is indispensable for the management operation of the controller itself or a task that requires a large amount of communication when executed by another controller is shunted, the controller will be down or the bottleneck of the communication volume of the network 1000. It may cause communication failure due to the neck. To prevent this, this procedure is used to select those tasks as the tasks to be executed after backup. Further, this means informs the whole system of the result of the backup. This procedure will be referred to as a backup acceptance procedure, and the details thereof will be described later by a specific example. Here, an outline thereof will be described to explain the function of the present means.

This means includes steps 6710 to 6730.
Then, among the tasks to be backed up and the plurality of tasks executed by the processor in charge of backup, the processor in charge of backup selects a task to be executed after backup in accordance with the priority. At this time, in order to prevent the own controller from going down due to the backup, the tasks essential to the management operation of the own controller, such as the task of providing the communication unit 6110, the backup request unit 6120, and the scheduler 6140, are given the highest priority. select. Network 10
In order to prevent the communication volume bottleneck of 00 from becoming actual and causing communication failure, the task that requires a large amount of communication when executed by another controller is selected next with priority. Then select other tasks. In each priority, the task of the combination that has the maximum load is selected within the range in which the load of the processor in charge of backup does not exceed the limit value. The limit value of this load is stored in the storage means 6160 and is called the limit load factor. This selection is the same as the procedure 6530 of the internal backup procedure of FIG. Further, in this selection, even if the processor in charge of backup has executed the task before the backup, it may not be executed after the backup if the priority is low. Subsequently, the present means registers the selected task in the scheduler 6140 and executes the execution means 615.
Start execution at 0. The task ejected from the processor in charge of backup is the scheduler 6140.
And stop its execution.

Subsequently, in step 6740, this means broadcasts a message 6700 containing information indicating the task to be backed up and the task to be ejected on the network. This message 6700 informs all the other controllers of the change in the execution state of the own controller. Further, in this means, all the controllers have respective storage means 6160, 6260, 636.
The execution allocation table, task load table, and external acceptance ranking table stored in 0, 6460 are rewritten by this message 6700. Also, as mentioned above, this message 67
Backup requesting means (622
0, 6320, 6420) deletes the backed up task from the tasks to be backed up and adds the evicted task to the tasks to be backed up.

In this way, a plurality of tasks executed by one down or overloaded controller are divided according to the load of the operating controller requested to be backed up, and finally a plurality of tasks are executed. Backed up by the controller. That is, in the distributed control system of the present invention, when one controller goes down or overloads, a plurality of operating controllers share the backup according to their own load conditions. further,
In order to suppress an increase in network traffic in this backup, the backup is shared according to the attribute of the task traffic.

FIG. 47 shows the physical configuration of this distributed control system. The controllers 1, 2, 3, 4 have the same configuration, and each of them is connected to the network 1000 by a network connection connector 41a, 41b, 41c, 41d.
And four processors (PR1, PR) connected to each of these network connection connectors via serial data buses 71a, 71b, 71c, 71d.
2, PR3, PR4) 701-704, 711-71
4, 721 to 724, 731 to 734, these processors (PR1, PR2, PR3, PR4) and bus 70
Global memories 82a, 82b, 82c and 82d connected via a, 70b, 70c and 70d, and an input / output processing device (I / O) 83a connected to these processors (PR1, PR2, PR3 and PR4) , 83b, 83
c, 83d, and a bus 70b connected to these processors and notifying of a failure. DC for each controller
The names are 1, DC2, DC3, DC4. PR1, PR2, PR for each processor in each controller
I named it 3, PR4. Here, it is assumed that each processor is executing the task described therein. Here, tasks NC1, NC2, NC3, NC4 are tasks for controlling transmission / reception of messages between controllers via the network 1000, and the communication means 611 in FIG.
0, 6210, 6310, 6410 are provided. Further, tasks CM1, CM2, CM3, and CM4 are tasks that control the execution of tasks in the controllers 1, 2, 3, and 4, and backup request means 6120 and 622 in FIG.
0, 6320, 6420 and backup acceptance means 61
30, 6230, 6330, 6430 are provided. Tasks starting with T are control calculation executed by each controller and provide the control means of FIG. OS1
A task starting with OS such as 1 is a real-time operating system incorporating a backup-related function, and is executed by each processor. Each of these is the internal backup means 6170, 6270, 637 of FIG.
0,6470 is provided. Further, each of these real-time operating systems independently carries out scheduling for each processor. That is, each scheduler 6140, 6 of each controller
240, 6340, and 6440 are provided by being divided into parts related to each processor.

Further, the failure control circuit 68 in each processor
Reference numeral 20 (see FIGS. 8, 10 and 12) provides a disconnecting means by using the bus 70b as a communication path in cooperation with the failure control circuit of another processor. For example, if the processor 702 in FIG. 47 fails, the processor 70
The second failure control circuit detects the failure and the other processor 70
The failure of the processor 702 is notified to the 1, 703 and 704 via the bus 70b, and at the same time, the operation of the general-purpose engine (GE) of the processor 702 is stopped. Further, the respective failure control circuits of the processors 701, 703, 704 cause the tasks OS11, OS13, OS14, which provide the internal backup means executed in the respective processors PR, to start the internal backup procedure. As described above, the function of the disconnecting means 6180 in FIG. 43 is physically shared by the four processors.

Further, since all the processors in each controller of FIG. 47 have the run adapter (LA), all the processors have the communication means 6110, 621.
It is possible to operate as 0, 6310, 6410. In the prior art, the communication-related means were not redundant and the reliability was insufficient, but the configuration of the present embodiment makes them redundant and improves the reliability. Four run adapters (L
In A), the communication means 6110, 6210, 6 are actually used.
310 and 6410 are tasks NC1, NC2,
NC3 and NC4 are run adapters (LA) of the processor executing. That is, even if the run adapter (LA) operating as the communication means fails and communication is interrupted, the communication can be restored by backing up the tasks NC1, NC2, NC3, NC4 in the controller. Further, in the conventional technology, when the processor or the processor has a local memory, if the processor or the processor goes down, there is a problem that the learning result data for control stored in the local memory cannot be accessed. So local memory (LM) 68
16 is composed of a dual port memory and is connected to the bus 70a in addition to the bus 6819. By this connection, the local memory (LM) 6 from another processor via the bus 71a.
816 is now accessible. 4 processors in the controller (PR1, PR2, PR3, PR4)
The local memory (LM) and the global memory (GM) of the storage means 6160, 6260, 636 of FIG.
0,6460 is configured.

The backup method of this embodiment will be described below in detail. FIG. 48 is an execution allocation table in the operating state of FIG.
It is stored in 6360 and 6460. The contents of this table are the names that can identify the processor, the names of the tasks that the processor is executing, the load factor that the processor incurs due to those tasks, and the first number in the order of light load on each processor in each controller. It is the order numbered from (internal load order). In this example, the controller name and the processor name are concatenated to identify the processor.
There are other methods of specifying different numbers. The method used to specify this processor may be any method regardless of the gist of the present invention. Internal backup means 6170, 62 using this table
70, 6370, and 6470 search for tasks to be backed up from the names of the processors that are down or overloaded, and in the controller, search the internal load order in order from the processor with the smallest load to the processor with the largest load. Further, the backup acceptance unit 6130, 6230, 6330, 6440 uses the execution allotment table in order to retrieve the name of the task executed by the processor from the names of the processors requested to be backed up. Even if there is no internal load rank, the internal backup means can generate information equivalent to the internal load rank based on the processor name and the load factor, and execute the above processing.
Since this information is generated during the backup, it takes a long time to complete the backup. In this embodiment, in order to shorten the time until the backup is completed, the internal load order is generated and stored in this execution allocation table in the normal operating state.

FIG. 49 is a task load table in the operation state of FIG. 47, and each storage means 6160, 6260, 636.
0,6460. The contents of this table are the name of the task, the load factor when the task is executed, the attributes related to the backup, and the original register indicating which processor the task belongs to. There are four attributes, which are indispensable for the original processor but do not need to be (or should not) be backed up by other processors.
“Fixed”, which indicates that the task is a task, and “internall, which indicates that the task is required for controller management operation
y ”and“ communicative ”indicating that the communication volume is high
And "somewhere", which indicates that the task may be executed by a controller other than the original one. Therefore, a task that should be backed up by another processor has the attribute "fi
These are not "xed". When these are treated as priorities in a certain processor and arranged in descending order from the highest priority, the highest priority is "fi
xed ”, the next highest priority is“ internally ”where this processor is the original, the next highest priority is“ communicative ”where this processor is the original, and the lowest priority is this processor There is “somewher
e ”and this processor is not the original one“ fixed ”,“ intern
"ally", "communicative", and "somewhere", except for processors whose attributes are "fixed" or "int"
Backing up the “ernally” task causes a controller or system failure, so this is prevented in the backup procedure. In other words, the original processor or the controller containing it (called the original controller) has the highest priority. Internal backup means 6170, 627.
0, 6370, 6470 and backup acceptance means 61
30, 6230, 6330, 6440 selects the tasks to be executed after the backup based on the priority of each task, the original register and the load factor from the tasks to be backed up and the tasks executed by the processor in charge of the backup. This task load table is used to know their contents from the task name when doing.

FIG. 50 is an external acceptance order table in the operating state of FIG. 47, and each storage means 6160, 6260, 636.
0,6460. In this table, the backup requesting means 6120, 6220, 6320, 6420 first searches the processors of other controllers for the name of the processor with the smallest load factor, and then, if necessary, the names of the processors with the largest load in order. Used to do. This table lists processor names in ascending order with the load factor as a key. Therefore, although the information of this table is also included in the execution allocation table, it takes a considerable time to search the processor with the smallest load factor in the execution allocation table. Therefore, this table is provided for the purpose of shortening the search time. In this table, the processor name with the smallest load factor among all the processors can be known simply by reading the first processor name. If it belongs to the controller requesting the backup, read the next order. By repeating this process, the processor with the smallest load can be selected from the processors of other controllers. This table is rewritten every time it goes down, overloaded, or backed up, but it is deleted once because it is returned to the list once.
The ascending order of this table is maintained in the three steps of insertion. Therefore, when this external acceptance ranking table is used, it is not necessary to sort the contents of the execution allocation table at the time of backup, and the processing becomes faster. That is, the time required for backup can be shortened.

Here, the relationship among the contents of the execution sharing table, the task load table, and the external acceptance ranking table will be described. Processor DC
1. The tasks executed by PR1 are tasks OS11, NC1, CM1, and T11 according to the execution allocation table. The load factor at this time is 5% for the task OS 11 and NC1 from the task load table.
Is 26%, CM1 is 28%, and T11 is 13%, so the sum of these is 72%. Assuming that the load factor of the processor omitted in the example of the execution share table is sufficiently larger than this value, the processor DC1. Since the load factor of PR1 is the third in ascending order, it is ranked third in the external reception ranking table.

Here, as an aid in understanding the backup procedure of this embodiment, when the processor (DC1.PR1) 701 of the controller 1 goes down as shown in FIG. 51, the tasks NC1, CM1, and T11 are divided. The process of being backed up and the task evicted thereby will be further backed up by another processor. Here, it is assumed that the above-mentioned limit load factor is set to 90%.

(FD0) Processor 70 of controller 1
It is assumed that the processor 6811 of 1 fails. Due to this failure, the communication means 6110 and the backup request means 61
20 and the backup reception means 6130 went down, and each part of the scheduler 6140 and the control means 6150 went down.

(FD1) When the disconnecting means 6180 of the controller 1 detects that the processor 701 is down, this processor is stopped. At the same time, the internal backup means 6170 is notified that the processor 701 is down, and the internal backup means 6170 is caused to start the internal backup procedure of FIG.

More specifically, the failure control circuit (FD) 6820 of the processor 701 is a general-purpose engine (GE) 681.
When the failure of the processor 701 is detected, the failure control circuit (FD) of the other processor is notified of the failure of the processor 701 through the bus 70b. After that, the processor 701 is stopped. Failure control circuit (FD) 6 of processors 702, 703, 704
Upon receiving the notification of failure, each processor 681 receives the failure.
An interrupt request is issued to the signal 1 using the interrupt request signal line of the bus 70a. This interrupt processing provides the task OS 12 and OS that provide the internal backup means 6170.
13. OS 14 starts the internal backup procedure.
The local memory (LM) of the stopped processor
Since the 6816 is connected to the bus 70a, it can be accessed by other processors even when this processor is stopped. This connection allows you to get the data you need when the processor backs up and resumes, even when the processor is stopped.

The internal backup procedure shown in FIG. 46 executed by the internal backup means 6170 will be described below.

(OS0) The internal backup means 6170 is activated. More specifically, the task of controlling the internal backup in all the operating processors is independently shown in FIG.
Perform the internal backup procedure for. In the example of FIG. 51, the task OS 12 executes the internal backup procedure in the processor (DC1.PR2) 702. Processor (DC1.P
In R3) 703, the task OS 13 executes the internal backup procedure. The task OS 14 executes the internal backup procedure in the processor (DC1.PR4) 704. The task that is not in charge of backup stops by itself, and the one that automatically performs backup is determined. Since there is no specific backup dependency between the processors, it is possible to have uniform hardware and uniform software in the controller, which facilitates the construction of the controller. Thus, the internal backup procedure of FIG. 46 was constructed. The next step will explain this decision method.

(OS1) Procedure 6510: The internal backup means 6170 determines the processor with the smallest load among the above operating processors as the processor to be backed up.

Specifically, each of the above tasks reads out the internal load ranking of the down processor and its own internal load ranking from the execution allocation table. If the load of the processor that has gone down is the smallest, the internal load ranking is first as described above. Therefore, if the internal load rank is 1, the processor with the smallest load among the operating processors has the second internal load rank. In this case, the internal load ranking of itself is 2
By determining that it is the turn, it determines whether or not it is in charge of backup. If the internal load rank is No. 2, the backup is in charge, and the process proceeds to step 6520. If the internal load rank is not 2, the internal backup procedure is terminated and the backup is not taken charge of. On the other hand, when the load on the operating processor is smaller than the load on the down processor, the processor having the smallest load among the operating processors has the first internal load rank.
In this case, by determining that the internal load rank of the self is the first, it is determined whether the self is in charge of backup. If the internal load rank is first, the backup is in charge, and the procedure proceeds to step 6520. If the internal load ranking is not first, the internal backup procedure is terminated and the backup is not taken charge of.

In the example shown in FIG. 51, the processor is down.
The internal load rank of (DC1.PR1) 701 is No. 2 as shown in the execution share table of FIG.
Since the internal load rank of PR2) 702 is 4, the task OS 12 ends the internal backup procedure in procedure 6510. Further, since the internal load rank of the processor (DC1.PR3) 703 is 3, the task OS 13 ends the internal backup procedure in procedure 6510. On the other hand, the internal load rank of the processor (DC1.PR4) 704 is 1
Therefore, the task OS 14 proceeds from step 6510 to step 6520 and continues the internal backup procedure. Therefore, the processor (DC1.PR4) 704 first performs the backup.

(OS2) Step 6515: The internal backup means 6170 registers in the task queue those tasks which cannot be executed due to the down and which need to be backed up. For details, first, initialize the task queue for reception. Then, the task names corresponding to the names of the downed processors are read from the execution allocation table, and the load factors and attributes for those tasks are read from the task load table. And "fixed", which indicates that the attribute does not need to be backed up or should not be backed up
Exclude the ones that are registered in the reception task queue as tasks to be backed up. In the example of FIG. 51, the name DC of the down processor (DC1.PR1) 701
1. OS11 and NC1 which are task names corresponding to PR1
And CM1 and T11 are read from the execution sharing table, and the respective load factors 5%, 26%, 28%, 13% and the attributes "fixed", "communicative" and "somewhere" are read from the task load table. . Then, except for the information about the task OS 11 whose task attribute is "fixed", these contents are registered in the accepting task queue.

(OS3) Step 6520: The internal backup means 6170 adds the task executed by the processor in charge of backup to the accepting task queue.
Specifically, the task names corresponding to the names of the processors in charge of backup are read from the execution allocation table, and the load factors and attributes for those tasks are read from the task load table. Then, those tasks are added to the reception task queue. At the same time, those load factors and attributes are also added.

After this procedure, it is repeatedly executed until all the processors in the controller are in charge of backup or until there are no tasks to be backed up. In this execution in the example of FIG. 51, the name D of the processor 704 in charge of backup
C1. OS14 and T1 which are task names corresponding to PR4
7 and T18 are read out from the execution allocation table, and the respective load factors 5%, 25%, 26% and the attribute "fixe" are read from the task load table.
"d", "internally", and "communicative" are read. These are added to the task queue for reception.

(OS4) Step 6530: The internal backup means 6170 selects a task to be executed by the processor in charge of backup after the backup from the accepting task queue. Specifically, sort the reception task queue by priority and load factor according to task attributes, select the combination that is closest to the limit load factor among the tasks with high priority, and then select all. Also, if there is a margin in the load factor, a combination that comes closest to the margin is selected among the tasks of the next priorities. This combination and selection are repeated until some of the tasks of any priority cannot be selected. In the example of FIG. 51, the accepting task queue has the content shown in FIG. 52, and the task OS 14 and NC1
And CM1 and T17 are finally selected. Here, the tasks that are backed up are NC1 and CM1, the tasks that are not backed up are T11, and the tasks that are evicted are T18.

(OS5) Step 6540: Delete the task selected in the previous step from the accepting task queue. Specifically, the name of the task selected in the previous procedure, its load factor, and its attribute are deleted from the accepting task queue. In the example of FIG. 51, the task OS 14, NC1, CM1, and T17 are finally selected. In this procedure, these tasks are deleted from the reception task queue. The task left in the reception task queue is the task T11 that was not backed up.
That is the task T18 that was expelled.

(OS6) Step 6550: The task selected in Step 6530 is registered in the scheduler 6140 and execution is started. Specifically, the task to be backed up is additionally registered to the task to be responsible for scheduling the processor in charge of backup, and the registration of the task to be expelled is deleted. In the example of FIG. 51, the tasks NC1 and CM1 that are the tasks to be backed up are additionally registered in the task that is in charge of the scheduling of the processor 704 that is in charge of backup, that is, the task OS14 that is the real-time operating system, and execution is started. Also, the task T18, which is the task to be expelled, is deleted from the scheduler and execution is stopped.
Here, the communication unit 6110 and the backup request unit 612, which have been down due to the failure of the processor 701.
0 and backup acceptance means 6130 have been restored. After that, communication with the network 1000 necessary for backup between controllers and execution of control tasks can be executed.

(OS7) Procedure 6560: This procedure branches the internal backup procedure into three ways according to the backup status. One is a branch to a process for ending the procedure related to the backup because the backup has been completed completely. The second is a branch to the process of completing the internal backup and starting the backup between the controllers. The third is a branch to the process of repeating the internal backup. Create these branches in step 6560 in step 6560.
2,6564,6566 are implemented. Step 6562
Determines whether there is a task to be backed up, that is, a task with a high priority among the tasks remaining in the reception task queue, and if there is, the process proceeds to step 6564. If not, the process proceeds to step 6566. Step 65
Reference numeral 64 determines whether or not all processors in the controller are in charge of backup. If all processors are in charge of backup, the process branches to the process of starting backup between controllers after step 6574. If not assigned to all, the process branches to a process of repeating internal backup after step 6580. Step 6
566 determines whether or not there is a task to be backed up, that is, whether or not there is a task in the reception task queue, and if there is a task, the process performs backup between the controllers after step 6574. Branch to the process to start. If no task remains, the process branches to a process for ending the procedure related to backup after step 6572.

In the example of FIG. 51, this time, the task T11 having the attribute "communicative" and a high priority remains in the reception task queue, and the processor 704 is only in charge of the backup. , And branches to a process of repeating internal backup after step 6580.

(OS8) Step 6580: The processor with the next smallest load of the processor in charge of the backup this time is selected as the processor in charge of the next backup, and the procedure returns to step 6520 to execute the next backup. For details, read the internal acceptance order of the processor in charge of backup this time and the internal acceptance order of the downed processor from the execution allocation table. 1 is added to the former value to obtain the next internal reception order. When this value is the latter acceptance order, 1 is further added to prevent designation of a down processor. In the controller, the processor whose internal acceptance order is this value is obtained from the execution allocation table. Select the required processor as the next person in charge of backup. In the example of FIG. 51, the internal reception order of the processor 704 that is in charge of the backup this time is 1, and the internal reception order of the down processor is number 2. Therefore, the internal reception order of the processor that is in charge of the backup next time is 3
It's my turn. Therefore, the processor 703 having the third internal acceptance order in the controller 1 in the execution allocation table is selected as the person in charge of the next backup. We are now in the second internal backup. The procedures described above describe only the explanation related to the example of FIG.

(OS9) Procedure 6520: In this execution in the example shown in FIG.
3 is in charge. So its name DC1. OS13, T15, and T16, which are task names corresponding to PR3, are read from the execution allocation table, and each load factor 5 is read from the task load table.
%, 28%, 41% and attributes "fixed", "somewhere",
“Communicative” is read out. These are added to the reception task queue.

(OS10) Step 6530: In the example shown in FIG. 51, the accepting task queue has the contents shown in FIG.
The tasks OS13, T15, T16, and T11 are finally selected. Here, the task that is backed up is T11, the task that is not backed up is T18, and there is no task that is evicted.

(OS11) Procedure 6540: In the example shown in FIG. 51, the tasks OS13, T15, T16 and T11 are finally selected. In this procedure, these tasks are deleted from the reception task queue. The only task left in the accepting task queue is task T18 that was not backed up.

(OS12) Procedure 6550: In the example of FIG. 51, the task responsible for scheduling the processor 703 responsible for backup, that is, the task OS13 which is the real-time operating system, additionally registers the task T11 which is the task to be backed up. Start execution. In addition, since there are no tasks to be evicted, there is nothing that can be deleted from the scheduler and execution stopped.

(OS13) Procedure 6560: In the example of FIG. 51, this time, only the task T18 whose attribute is "somewhere" and which does not need to be prioritized remains in the reception task queue. That is, in this state, there are no tasks with high priority remaining, but there are tasks that should be backed up. Therefore, this procedure branches the processing to the processing of starting backup between controllers after the procedure 6574.

(OS14) Procedure 6574: Broadcast a message 6700 indicating a new execution state to the network 1000. This message allows other controllers to know the processor down and the new execution state of the processor responsible for the backup. In accordance with the contents of this message 6700, each controller modifies the execution allocation table, task load table, and external acceptance ranking table stored in each storage means.
In the example of FIG. 51, the message 6700 indicates that the processor 701 is down as down information. Further, as new execution statuses, task OSs 13, T15, T16, and T11 executed by the processor 703 and task OSs 14, NC1, and CM executed by the processor 704 are executed.
1, T17. The modified execution sharing table and external acceptance ranking table are shown in FIGS. 55 and 56.

(OS15) Step 6590: The backup requesting means 6120 is activated to carry out a backup between the controllers. Specifically, the remaining tasks to be backed up are moved from the accepting task queue to the requesting task queue used by the backup requesting means 6120, and the accepting task queue is emptied. Then, the backup request means 6120 is notified that there are tasks remaining to be backed up. This notification may be performed using the intertask communication function of the real-time operating system. Alternatively, the message may be transmitted from the own controller via the nutwork 1000 to the own controller.

(OS16) With this, the internal backup procedure is completed.

Then, the controller moves to the backup procedure, and the task T18 is backed up by another controller.

(CM1) The backup requesting means 6120 of the controller 1 is activated to start executing the backup requesting procedure shown in FIG.

(CM2) Procedure 6610: The backup requesting means 6120 uses the external acceptance ranking table, and the processor with the smallest load among the processors of other controllers different from the non-controller blowing the down processor is designated as the backup request destination. decide. For details, read the processor name with the first rank from the external reception order table. If the processor belongs to another controller, the reading is stopped there, and the processor becomes the backup request destination. If it belongs to the same controller as the down processor, the processor name of the next rank is read again from the external reception rank table. Then, it is determined whether or not it belongs to another controller. The above is repeated until the processor belonging to another controller is read. In the example of FIG. 51, the backup in the controller including the down processor is completed,
The external reception order table of 0 has been changed to FIG. The processor name of the first rank is read from the external reception rank table of FIG. Its name is DC2.PR2 and this processor belongs to the controller DC2. Since the controller including the down processor is DC1, the read processor belongs to a controller different from the controller including the down processor. Therefore, this processor (DC2.PR2) 712 is determined as the processor requesting the backup without returning to the process of reading the processor name of the next rank. This processor is called the request destination.

(CM3) Step 6620: Create a message 6600 including information indicating that the backup requesting means 6120 is a backup request and information indicating all task names registered in the requesting task queue, Send to the request destination. This message is called a request message. In the example of FIG. 51, the request message 66
00 is a request for backup of the task T18, and is sent to the processor 712 which is the request destination via the network 1000.

(CM4) Procedure 6630: The backup requesting means 6120 sends a message 6 requesting backup
It waits for a message 6700 broadcast from the backup request destination as an answer to 600.

Thereafter, the backup requesting means 6120 suspends the backup requesting procedure and waits until the message 6700 is broadcast. The operation of the backup acceptance unit 6230 of the request destination will be described below.

(CM5) In the controller 2 including the requested processor 712, the communication means 6210 receives the message 6500, and the backup acceptance means 6230.
To start. The backup acceptance unit 6230 starts the backup acceptance procedure of FIG. Here, the backup acceptance unit 6230 uses the acceptance task queue and task load table stored in the storage unit 6260 of the controller including itself.

(CM6) Step 6710: The backup accepting means 6130 registers the task requested by the message 6600 and the task executed by the processor requested for backup in the accepting task queue. In detail, the backup acceptance unit 6230 first stores the storage unit 62.
The task queue for reception in 60 is initialized. Then, the name of the task requested from the message 6600 is extracted, the load factor, the attribute, and the original register corresponding to the task name are read from the task load table in the storage means 6260, and are stored in the reception task queue initialized earlier. to register. Further, the storage means 6
The task name corresponding to the name of the requested processor is read from the execution sharing table in 260, and the load factors and attributes for those tasks are read from the task load table. Then, those tasks are added to the reception task queue. At the same time, those load factors and attributes are also added.

In the example of FIG. 51, the name T18 of the task requested to be backed up by the message 6600 is registered in the accepting task queue. At the same time, from the task load table, the load factor 26% and the attribute "somewher" corresponding to the name
e ”and original DC1.PR4 are read and these are registered. Furthermore, the processor 71 requested to back up
2 is the name of the task being executed by the processor name DC2. Task name OS22 and T21 corresponding to PR2
And T22 are read from the execution allocation table. Furthermore, from the task load table, the load factors corresponding to each task are 5%, 18%,
35% and attributes "fixed", "communicative", "somewh"
ere ”and original DC2.PR2, DC2.PR2, DC2.
Read out PR2. Then, the task name, the load factor, the attribute, and the original register are added to the reception task queue.

(CM7) Procedure 6720: The backup accepting means 6130 selects a task to be executed by the processor requested for backup after the backup from the accepting task queue. Specifically, sort the reception task queue by priority and load factor according to task attributes, select the combination that is closest to the limit load factor among the tasks with high priority, and then select all. Also, if there is a margin in the load factor, a combination that comes closest to the margin is selected among the tasks of the next priorities. Until some of the tasks of any priority cannot be selected, or
This combination and selection are repeated until all tasks are selected. In the example of FIG. 51, the accepting task queue has the content shown in FIG. 54, and the task OS22, T21, T23, and T18 are finally selected. Here, the task to be backed up is T18, there is no task that is not backed up, and there is no task that is evicted. That is, all the tasks in the accepting task queue have been selected.

(CM8) Procedure 6730: The backup acceptance means 6130 registers the tasks selected by the previous procedure in the scheduler 6240 and starts their execution.
Specifically, the task to be backed up is added to the scheduler 6240, registered, and its execution is started. Further, the registration of the task to be expelled is deleted from the scheduler 6240 and its execution is stopped. In the example of FIG. 51, the task T18 is registered and execution is started. There is nothing to delete a registration.

(CM9) Step 6740: The backup accepting means 6130 broadcasts a message 6700 indicating the new execution state of the processor requested for backup to the network 1000. This message 6700 is information indicating that it is a response to the backup request, information on the task executed by the processor requested for the backup when the backup acceptance procedure is completed, and the task requested for the backup. It includes information indicating the backed up task and information indicating the task that has been evicted from the processor requested to back up and its execution has been stopped. From this message, the other controller knows the new execution state of the processor requested for backup, and modifies the execution allocation table, task load table, and external acceptance ranking table stored in each storage means. Further, this message 6700 causes the backup requesting means 612 which is the backup request source.
0 exits the waiting state and restarts the backup request procedure. In the example of FIG. 51, a message 6700 indicates the task OS22, T21, T22, T18 that the processor 712 is executing as a new execution status. Task T18 is shown as a backed up task. Since there is no corresponding task that has been evicted, it indicates that there is no evicted task.

(CM10) Backup acceptance means 623
0 ends the backup acceptance procedure.

Hereinafter, the processing of the backup request procedure 6120, which is restarted by the message 6700, will be described.

(CM11) Step 6642: The backup requesting means 6120 takes out the information indicating the backed up task from the message 6700. Then, it is determined whether or not there is a backed up task. If there is no backed up task, it is determined in step 6644 whether or not all processors have been requested to back up. Further, if all the processors have not been requested, the external load ranking table is referred to in step 6646, and the processor with the smallest load next to the request destination this time is selected as the request destination. Then, the backup request is repeated again after step 6620. In step 6644, if it is after all the processors have been requested, the backup has failed, and the degenerate operation means is activated to perform the degenerate operation. Now, return to step 6642. Here, if there is a backed up task, the procedure goes to step 6650.

In the example of FIG. 51, the task T18 has been backed up, so the procedure proceeds to step 6650.

(CM12) Procedure 6650: The backup requesting means 6120 changes the execution allocation table, task load table and external acceptance ranking table in the storage means 6160 according to the contents of the message 6700. In the example shown in FIG. 51, the microphone and the computer DC2. The task T18 is added to the column of the task executed by PR2. Similarly, the load factor column is changed from 58% load factor to 84%. The internal load order of the controller 2 (DC2) is changed, and the processor DC2. PR1 to second, processor DC2.PR
2 to 4, processor DC2.PR3 to first, processor DC2.PR3. Set PR4 to number 3. In the external acceptance ranking table, the processor DC2. PR2 has a load factor of 8
Since it was 4%, it is turned to the back and the rank of the processor with a load factor of 84% or less is advanced one by one. Therefore, the processor with the first external reception order is DC3. PR1
become.

(CM13) Step 6660: The backup requesting means 6120 deletes the backed up task indicated by the message 6700 from the requesting task queue. In addition, message 6 is sent to the requesting task queue.
Add the evicted task as shown at 700. This operation is provided so that all backups do not have to be completed by one backup request. That is,
If there is a task that could not be backed up in one backup, or a task that was evicted to increase the load factor, the task remains in the requesting task queue and is assigned to a request destination different from this request destination. This is the one that can be requested next time. In the example of FIG. 51, the task T18 is deleted from the requesting task queue and the requesting task queue becomes empty.

(CM14) Step 6670: The backup requesting means 6120 judges whether or not any task remains in the requesting task queue. If it remains, the procedure returns to step 6610 again to determine a new request destination and request backup. Also, if no tasks remain in the requesting task queue, it means that backup of all tasks has been completed. At this time, backup request means 6
Step 120 ends the backup request procedure.

(CM15) Backup requesting means 612
0 ends the backup request procedure.

Through the above steps, the distributed control system of the present embodiment, when one processor (DC1.PR1) 701 goes down, performs the tasks NC1 and C executed there.
M1 and T11 are autonomously divided and each is backed up by the processor (DC1.PR4) 704 of the controller 1, the processor (DC1.PR3) 703 of the controller 1, and the processor (DC2.PR2) 712 of the controller 2. In the example shown in FIG. 51, the controller having the down processor and the controller requesting the backup are the same. However, according to the gist of the present invention, since each of the controllers 1, 2, 3, and 4 has the execution allocation table that describes the execution states of all the controllers, when one controller is down, the other one is executed. It is possible for a controller to ask another controller for backup. Specifically, in the example of FIG. 51, the controller 1
CM1 backed up by the processor 704 of
The backup request means 6120 provided by the task CM2 executed by the processor 711 of the controller 2 is replaced by the backup request means 6120 provided by the execution request table and the external acceptance order table stored in the storage means 6260. You can also request a backup. Therefore, the execution allocation table, the task load table, and the external acceptance ranking table store the states of all the controllers or all the processors. In the example of FIG. 51, the backup requesting means of the controller that detects the down is activated.

Although this embodiment is a system having four controllers, it can be expanded to a system having two or more controllers without departing from the spirit of the present invention. Further, in the present embodiment, one controller includes four processors, but it can be expanded to a system having one or more processors without departing from the spirit of the present invention.

[0179]

According to the present invention, one controller has a numerical operation function as well as a parallel operation function for high-speed operation of neuro, fuzzy, matrix, etc., a processor for high-speed sequence control operation, and a network. A controller that can be applied to a wide range of fields can be realized by being configured with a plurality of processors such as a processor that executes a communication function with and enabling each function in parallel. A distributed control system applicable to a wide range of fields can be realized by connecting this controller to a network.

Also provided is a method for implementing a chip capable of functionally programming input / output and processor. As a result, a small number of types of controllers can handle a wide variety of control targets, and a system excellent in maintainability can be configured.

By configuring each processor with processor elements in smaller units, flexibility is improved, LSI can be easily formed, and the controller can be miniaturized. Therefore, the controller body can be downsized,
A controller that can be distributed and installed can be realized. Further, by providing the spare processor and the spare area of the non-volatile memory, the controller itself can self-repair against a partial failure.

Further, by adopting an external structure with a bus connector that allows easy expansion of the bus, it is possible to deal with a wide range of control targets from small scale to large scale.

In addition, a program written by the user and a plurality of outputs obtained by a plurality of output generating means such as a neural network are adaptively combined with the learning situation and changes with time to enable better control. , It is possible to control the user's preference with a simple operation.

Further, according to the present invention, it is possible to prevent a communication neck from occurring due to a large amount of abnormal information in the network when a common mode failure occurs in the distributed control system. In addition, it is possible to identify the failure point in the distributed control system.

Furthermore, according to the present invention, even in the case of multiple down of the controllers of the distributed control system, it is possible to autonomously distribute the load to the operating controllers and back it up. Furthermore, since the controller of the distributed control system is composed of a plurality of processors according to the present invention, even if multiple processors in the same controller are down, the load can be autonomously distributed and backed up to the operating processors. . Therefore, it is possible to improve reliability and fault tolerance.

[Brief description of drawings]

FIG. 1 is a plant control system according to an embodiment of the present invention.

FIG. 2 is a conventional steel rolling control system.

FIG. 3 is a steel rolling control system which is a specific application example of the present invention.

FIG. 4 is a control system for an automobile, which is another specific application example of the present invention.

FIG. 5 is an automobile control system as another specific application example of the present invention.

FIG. 6 is a system configuration example when the present invention is applied to a hierarchical system.

FIG. 7 is an internal configuration diagram of a controller that is an embodiment of the present invention.

FIG. 8 is an internal configuration diagram of a controller that is an embodiment of the present invention.

FIG. 9 is an internal configuration diagram of a controller which is another embodiment of the present invention.

FIG. 10 is an internal configuration diagram of a controller which is another embodiment of the present invention.

FIG. 11 is an internal configuration diagram of a controller which is still another embodiment of the present invention.

FIG. 12 is an internal configuration diagram of a controller which is still another embodiment of the present invention.

FIG. 13 is an overall block diagram of a function programmable controller.

FIG. 14 is a configuration example of a switch array in which a connection between input and output is programmable using a nonvolatile memory.

15 is a configuration example of a memory cell in the switch array shown in FIG.

FIG. 16 shows an embodiment in which a spare area is provided in the switch array.

FIG. 17 is an internal configuration example of a processor using a nonvolatile memory as a micro program memory.

FIG. 18 is an embodiment in which each processor is configured by a combination of processor elements.

FIG. 19 is an internal configuration diagram of the I / O 83.

FIG. 20 is a configuration diagram in which the I / O 83 is realized by a one-chip semiconductor.

FIG. 21 is a configuration diagram in which the I / O 83 is realized by a one-chip semiconductor.

FIG. 22 is a configuration diagram in which a controller 1'of the present invention is realized by a one-chip semiconductor.

FIG. 23 is a configuration diagram in which a controller 1'of the present invention is realized by a one-chip semiconductor.

FIG. 24 is a diagram showing the appearance of a controller that is an embodiment of the present invention.

FIG. 25 is a diagram showing the appearance of a controller that is one embodiment of the present invention.

FIG. 26 is a diagram showing the appearance of a controller that is one embodiment of the present invention.

FIG. 27 is a diagram showing the appearance of a controller that is one embodiment of the present invention.

FIG. 28 is a basic configuration diagram of a control calculation unit according to the present invention.

FIG. 29 is an overall schematic diagram of a control calculation unit in the present invention.

FIG. 30 is a configuration of an output calculation unit.

FIG. 31 shows a configuration of an evaluation unit.

FIG. 32 is an overall schematic diagram in the case of having a plurality of evaluation criteria.

FIG. 33 is a basic configuration diagram when a weight value is generated by a neural network.

FIG. 34 is a block diagram of a distributed controller with a diagnostic function.

FIG. 35 is an example diagram of constraint conditions of each controller in the distributed system.

FIG. 36 is a configuration diagram of a communication interface of each controller.

FIG. 37 is an abnormal information format diagram.

FIG. 38 is a processing procedure diagram of abnormal signal transmission processing when constraints are not satisfied.

FIG. 39 is a processing procedure diagram of an unnecessary information determination algorithm.

FIG. 40 is a diagnostic information acquisition determination processing procedure chart.

FIG. 41 is a processing procedure diagram of failure information.

FIG. 42 is an exemplary diagram showing an inclusion relationship of abnormality information.

FIG. 43 is a logical configuration diagram of the autonomous distributed control system.

FIG. 44 is an autonomous backup request procedure diagram.

FIG. 45 is an autonomous backup acceptance procedure diagram.

FIG. 46 is an internal backup procedure diagram.

FIG. 47 is a physical configuration diagram of the autonomous distributed control system.

FIG. 48 is an example diagram showing an execution allocation table.

FIG. 49 is an example diagram showing a task load table.

FIG. 50 is an example diagram showing an external reception ranking table.

FIG. 51 is an example diagram showing a backup method for an autonomous distributed control system.

FIG. 52 is an example diagram of a reception task queue in the first internal backup.

FIG. 53 is an example diagram of a reception task queue in the second internal backup.

FIG. 54 is an example diagram of a receiving task queue in the first external backup.

FIG. 55 is an example diagram showing an execution allocation table after internal backup.

FIG. 56 is an example diagram showing a reception order table after internal backup.

[Explanation of symbols]

1, 2, 3, 4, 5, 6, 6000 ... Controller, 4
0 ... NCP, 41a, 41b, 41c, 41d ... Network connection connector, 52, 82, 82a, 82b,
82c, 82d ... Global memory, 53 ... I / O, 5
4, 56, 58, 84, 87, 90, 93 ... Processor, 55, 57, 59, 85, 88, 91, 94 ... Local memory, 60, 61, 62, 63 ... Bus expansion connector, 64 ... I / O connector, 70a, 70b, 70
c, 70d ... Bus, 71a, 71b, 71c, 71d ...
Buses for serial data communication, 72a, 72b, 72
c, 72d ... Bus for notification of failure, 83a, 83b, 83
c, 83d ... Input / output processing device (I / O), 86, 89,
92, 95 ... Run adapter, 100 ... Plant, 70
1, 702, 703, 704 ... Processor of controller 1, 711, 712, 713, 714 ... Controller 2
Processor, 721, 722, 723, 724 ... Processor of controller 3, 731, 732, 733, 7
34 ... Processor of controller 4, 1000 ... Network work, 2001 ... Input data from sensor, etc.
2002 ... Input data, 2003 ... Output data, 200
4 ... Output data to actuator etc. 2010 ... Sensor etc. 2011 ... Input processing unit 2012 ... Output calculation unit,
2013 ... Output processing unit, 2014 ... Actuator, etc.
2015 ... Evaluation unit, 1200 ... Man-machine device, 201
7 ... Pointing device such as touch panel and mouse, 2021 ... Weighting unit, 2022 ... Output data synthesizing unit, 2101 ... Neural network, 2102 ... Output generating means 2, 2103 ... Output generating means 3, 2122 ...
Weight value update signal, 6110, 6210, 6310, 64
10 ... Communication means, 6120, 6220, 6320, 64
20 ... Backup requesting means, 6130, 6230, 6
330, 6430 ... Backup acceptance means, 6140,
6240, 6340, 6440 ... Scheduler, 615
0, 6250, 6350, 6450 ... Control means, 616
0, 6260, 6360, 6460 ... Storage means, 617
0, 6270, 6370, 6470 ... Internal backup means, 6180, 6280, 6380, 6480 ... Separation means, 6811 ... General-purpose engine (GE), 6812
... Neural engine (NE), 6813 ... Sequence engine (SE), 6814 ... Run adapter (LA),
6815 ... Free-run timer (FRT), 6816 ... Local memory (LM), 6817 ... Bus interface (BIF), 6818 ... Direct memory access control (DMAC), 6819 ... Bus in processor, 682
0 ... Failure control circuit.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Katsunari Shibata, 1-280, Higashi Koikekubo, Kokubunji City, Tokyo, Central Research Laboratory, Hitachi, Ltd. (72) Inventor, Kiyoshi Matsubara 5-2-1, Josuihonmachi, Kodaira-shi, Tokyo Incorporated company Hitachi Ltd. Semiconductor Division (72) Inventor Yasuo Morooka 7-1, 1-1 Omika-cho, Hitachi City, Ibaraki Prefecture Incorporated Hitachi Ltd. Hitachi Research Laboratory (72) Inventor Makoto Funabashi 1099 Ozenji, Aso-ku, Kawasaki City, Kanagawa Prefecture Bachi Co., Ltd. Hitachi, Ltd. System Development Laboratory

Claims (21)

[Claims] 1. A distributed control device comprising: a controller for a process having a plurality of control target devices, wherein a controller for issuing a control command to the control target devices is installed on site corresponding to each control target device. 2. In a controller for a control system comprising a plurality of processors, the plurality of processors in each controller have their own soundness / abnormality determining means and means for measuring or predicting the load of the processor, and one processor is abnormal. Alternatively, when predicting or detecting that the load will be overloaded, another processor substitutes the load. 3. In a distributed control system having a plurality of controllers and a transmission means for connecting the respective controllers, at least one controller among the controllers is composed of a plurality of processors, and the plurality of processors in the controllers are self-healing. / Abnormality determination means and means for measuring or predicting processor load, and when one processor is predicted or detected to be abnormal or overloaded, another processor in the same controller substitutes the load. A distributed control system characterized by the above. 4. In a distributed control system having a plurality of controllers and a transmission means for connecting the controllers, at least one controller among the controllers is composed of a memory or a plurality of processors sharing input / output, and the transmission means is A distributed control system characterized in that the contents of the memory or the input / output of the controller can be read / written regardless of whether the processor group in the controller is normal or abnormal. 5. In a distributed control system having a plurality of controllers and a transmission means for connecting the respective controllers, at least one controller is composed of a plurality of processors, and the processor group includes a communication processor for controlling the transmission means. A distributed control system characterized in that when the communication processor fails, another processor substitutes for the communication processor. 6. In a distributed control system having a plurality of controllers and a transmission means for connecting the controllers, at least one controller is composed of a plurality of processors, and when one of the processors fails, another processor A distributed control system configured to replace the faulty processor. 7. A controller for a control system comprising a plurality of processors, comprising first means (6180) for detecting a failure of each processor, second means (6160) for storing a load status of each processor, and A third means (6170) for controlling the load of the processor, and when the first means (6180) detects the failure of one processor, the second means (6160) stores each processor A controller characterized in that the third means (6170) divides the load of the failed processor into one or more other processors and substitutes them according to the load status. 8. In a controller for a control system having a plurality of processors, each processor executing a plurality of tasks, first means (6180) for detecting a failure of each processor, and a load condition of each processor. And a third means (6170) for controlling the load of each processor, and a first means (618).
0) detects the failure of one processor, the second
The third means (6170) selects and substitutes the task of the failed processor for one or more other processors according to the load status of each processor stored in the means (6160). The controller to do. 9. A controller for a control system comprising a plurality of processors, each processor executing a plurality of tasks, comprising: first means (6180) for detecting a failure of each processor; and load status of each processor. The first means (61) has a second means (6160) for storing and a third means (6170) for controlling the load of each processor.
When 80) detects the failure of one processor, the third means (6170) determines the task of the failed processor and other tasks based on the load status of each processor stored in the second means (6160). A controller which selects a task to be executed by each of the one or more processors from the tasks being executed by the one or more processors, and the processors execute the selected task. 10. In a controller for a control system having a plurality of processors, first means (6140) for detecting the load of each processor, second means (6160) for storing the load status of each processor, and Each processor has a third means (6170) for controlling the load of the processor, and when the first means (6140) detects an overload of one processor, each processor stored in the second means (6160). Means (6170) depending on the load situation of
A controller that divides the load of the processor whose load is over to one or more processors and substitutes it. 11. A controller for a control system comprising a plurality of processors, each processor executing a plurality of tasks, comprising: a first means (6140) for detecting a load on each processor; and a load status of each processor. The first means (6) has a second means (6160) for storing and a third means (6170) for controlling the load of each processor.
140) detects an overload of one processor, the third means (6170) performs the task of the processor that is overloaded according to the load status of each processor stored in the second means (6160). A controller that selects and replaces one or more processors. 12. In a controller for a control system having a plurality of processors, each processor executing a plurality of tasks, first means (6140) for detecting the load of each processor, and the load status of each processor. And a third means (6170) for controlling the load of each processor, and a first means (61).
40) detects that one processor is overloaded, the third means (6170) determines the overloaded processor based on the load status of each processor stored in the second means (6160). A controller characterized by selecting a task to be executed by each of the one or more processors from a task and a task being executed by one or more other processors, and the processors executing the selected task. 13. In a distributed control system having a network connecting a plurality of controllers and each controller, each controller measures the load of its own controller and transmits the measured load to the network (61).
40), second means (6120) for requesting another controller to substitute the load of an arbitrary controller, and third means for responding to the alternative request from another controller based on its own load status. When any of the controllers has an overload or a failure, the second means of the controller which detects the overload or the failure replaces the load in accordance with the load condition transmitted from each first means. Requesting the substitution of the load, and the third means of the requested controller defines the substitute load according to its own load situation, controls the execution of this load, and replies this substitution situation. A distributed control system featuring. 14. In a distributed control system having a plurality of controllers and a transmission means for connecting the respective controllers, at least one controller comprises a global memory or a plurality of processors sharing input / output, said processor comprising a cache memory and said processor. It has means for matching the contents of the cache memory and the contents of the global memory,
A distributed control system characterized in that the contents of the global memory or the contents of input / output can be read from another controller via the transmission means. 15. A distributed control system comprising a plurality of controllers and transmission means for connecting the respective controllers, wherein at least one controller has an input / output, and the connection of the input / output is programmable. system. 16. In a distributed control system having a plurality of controllers, at least one controller is composed of a plurality of processors, and each of the plurality of processors determines its own soundness / abnormality, and measures the load of each processor. And a processor having the least load, among the other processors, the processor with the smallest load replaces the load. 17. A controller for a control system having a plurality of processors, wherein at least one of the plurality of processors executes a neuro operation, a fuzzy operation, a numerical operation or a sequence operation. 18. A transmission line, which communicates with each other for exchanging information in the memory between a plurality of processors each having a memory for storing information, each memory, each processor and an external network. One processor has means for setting a network control function for controlling information exchange between the network and each memory,
By one processor identified by the above means,
A controller characterized by controlling information exchange between the network and the memory. 19. In a control system for obtaining a control output using an input from a sensor or the like, at least one of the inputs
An adaptation characterized in that a plurality of outputs calculated by a plurality of means or methods including one neural network are weighted and combined to generate a control output, and the value of the weighting is updated by learning. Control system. 20. In a distributed control system for executing control by connecting a plurality of controllers via a network, it is determined whether or not an abnormality detected by the plurality of controllers is to be transmitted to the network based on information received from the network. A distributed controller diagnostic method executed by each controller. 21. A single-chip controller containing a plurality of processors each having a programmable function and interconnection.