JPS60207907A - Backup system of control device - Google Patents

Abstract

PURPOSE:To improve the working efficiency of a system by connecting an on- line side I/O apparatus and a diagnozing I/O apparatus to a switching circuit to be controlled at its switching by a watchdog timer signal. CONSTITUTION:At the normal state of a working system 11, a switching control part 131 is actuated by a watchdog timer signal WDTM from the working system 11 and respective switching parts 132, 133 are turned to shown connected state. The working system 11 detects the connection to the on-line side by specifying an address of each on-line side I/O apparatus 15 and communicating with the I/O apparatus 15,... enters and operates a process detecting signal of a required process line from the I/O apparatus 15 to obtain an operation output signal and applies the operation output signal to an operation end 17 through the apparatus 15. A waiting system 12 is connected to the diagnozing I/O apparatus 18 through an off-line bus switching part 133. The waiting system 12 specifies the apparatus 18 having an address different from that of the apparatus 15 to transmit/received data to/from the apparatus 18 and decides that the system itself is in the off-line side and whether normal communication is possible or not to diagnoze the I/O apparatus 18.

Description

DETAILED DESCRIPTION OF THE INVENTION [A branch of the invention] The present invention relates to a check-up system for a control device used in a standby redundant system of a process control device or the like.

[Technical background of the invention]

This Yuzu backup system detects an abnormality in one control device and immediately switches to the other control device for backup.

This ensures smooth operation of the plant.

Conventionally, a device with the configuration shown in Figure 1 has been used. That is, this backup system.

It includes a regular system control device (hereinafter abbreviated as a regular system) 1 and a standby system control device (hereinafter abbreviated as a standby system) 2. One of these systems is connected to the detection end 4 via the switching circuit 3.
and is connected to at least one input/output device 6 that functions as an interface for the operating end 5. 7 is a host device, which has a CRT and is 6 series 1.

The plant is monitored and operated by exchanging information 1c with 2. 8 is an annunciator that outputs alarms for the upper and lower limit levels of the process and notifies failures of the input/output equipment 6, etc.; the switching circuit 3 includes a delay circuit 3, a switching control unit 32, an on-board bus switching contact 33. It consists of a digital output switching contact 34, an online designated switching contact 35, and the like.

Next, the operation of the backup system for the control device as described above will be explained.

+1) When regular system 1 is in a normal state.

The regular system 1 outputs a signal indicating that it is normal, that is, a zero-volt watchdog timer signal WDTM (M: M input 5T13R), and upon receiving this signal WDTM, the switching control section 32 such as a relay is activated. Energized n%6 contacts 33
~35 switches to the connection state shown in the figure! II is controlled. Therefore.

This condition is 1t! In the JIIC, the 0-volt online designated No. 1g DIM is output manually through the online designated switching contact 35 in the regular system 1, and the high impedance No. 100 DI is output from the offline side of the contact 35. , the standby system 2 is set offline *t7t, and the regular use 411C is connected to the input/output device 6 and the annunciator 8 via the online bus switching contact 33 and the dinotal output switching contact 34, respectively.

On the other hand, the standby system 2 is directly connected to the annunciator 8,
When an abnormality occurs during standby, a watchdog timer signal WDT8 (S:5LAVE) is output so that the annunciator 8 can generate the abnormality. The regular system 1 is also connected to the annunciator 8 in the same way, so that when there is an abnormality in the regular system, the watchdog timer <g WDT, VC can notify the abnormality.

(It) When regular system 1 becomes abnormal.

Watchdog timer 1g released from regular system 1
No. WDTM turns off and becomes high impedance.
During switching, the control unit 32 becomes de-energized and each contact 33~
35 is switched to the contact side opposite to that shown in the figure. here.

The standby system 2 receives an online designation signal DIS inputted from the online designation switching contact 35 (when it detects that the regular thread 1 is abnormal, the device 7 is notified to the host device 7). After downloading the data, the standby system 2 requests the latest parameters that are regularly collected from the regular system (the regular system), and takes over control after downloading the data. The operation output 1 is calculated by using the process detection signal inputted via the on-line bus switching contact 33, the output parameters, etc.
g is obtained and similarly supplied to the operating end 5 from the input/output device 6 via the process detection line to control the process line.

1) Repair and replacement of regular system 1 - Normally, the watchdog timer signal is the output obtained by monitoring whether the central processing unit in the control device, such as a microprocessor, is operating correctly or not. is generated by ORing each tfifi element with the output obtained by monitoring it via software.

Therefore, when the microprocessor starts operating correctly by using the illumination source of the regular system 1 that has been replaced by a repair worker, the watchdog timer signal WDTM outputs a normal signal before the software determines whether it is normal or abnormal. Because I do.

The switching circuit 3 operates immediately and operates each of the switching contacts 33-35.

If it is determined to be normal by the software diagnosis, there is no problem, but if the repair is not complete and the problem occurs again, the watchdog timer signal WDTM is activated by the software command.
Since the switch is turned off, there is a problem in that the relay of the switching control unit 32 may be temporarily operated due to replacing an incomplete device. Therefore, when the first diagnostic program starts running, a self-abnormality signal is issued by software in advance, and after the diagnosis, the system is switched to the regular system 1 according to the operator's instruction 1c. however.

In this case, a delay circuit 31 is installed at the input terminal of the switching control section 32 because it takes a non-negligible amount of time for the relays of the switching control section 32 to operate before the power is turned on and a self-abnormality signal is issued by the software. (Even if the watchdog timer WDTM is turned on for a short period of time, the relay etc. will not be activated 4 times.

When the regular system 1 returns to a normal state according to the above,
An operator checks or changes the control parameters etc. using a keyboard or a switch (not shown) having an equivalent function. Then, due to the excitation of the switching control unit 32, each of the contacts 33 to 35 is connected to the illustrated connection shape ra, F4.
Therefore, when the regular system 1 and the input/output device 6 are connected, control is taken over from the regular thread 1 to the standby system 2.This year, control is taken over from the standby system 2 to the regular system 1 using the same procedure. The process line o i++ is to be controlled.

[Problems with background technology]

Therefore, in the above-described backup system, when the regular system 1 is normal, the signal line of #device 2 with the input/output device 6 is disconnected, so the self-diagnosis of the connection interface with the input/output device 6 is not possible. I can't, therefore, regular use 1
Even if the connection of the standby system 21C is changed in the event of an abnormality, a problem arises in that it does not operate normally because the connected ink f face is defective. Also, when the regular system IVi power is turned on, a self-abnormality is output by watchdog timer 1g, while the standby system 2 stops diagnosing the input/output device connection interface part during the standby state, or even if it is diagnosed as abnormal, the watchdog timer 1g outputs a self-abnormality. This is not reflected in the way the dog timer signal is output.Because the software for this j-ci system J and the stand-by d system 2 are different, there is a risk that the 6th thread 1.2 may be repaired and replaced by mistake. .

[Object of the Invention] The present invention has been made by focusing on the above-mentioned points,
By making the software for the regular system and the standby system the same, it eliminates the hassle of replacing the main system for repairs, improves the reliability of the 6-thread standby redundant system, and enables auxiliary equipment for diagnosis personnel in the standby system. The object of the present invention is to provide a control device backup system that further increases the operating rate of the entire system including the 6th system and the climbing equipment.

Another invention has the same purpose as the above invention, and
The object of the present invention is to provide a backup system for a control device that makes the system convenient and expandable.

[Summary of the invention]

In the first invention, a switching circuit having an online bus switching section and an offline bus switching section is provided between the regular system and the standby system, and one online bus switching section side has an online side input/output device, and Ikekata A diagnostic human output device 2J is connected to the offline bus switching section side, and the 6th system uses the diagnostic human output device when offline to perform a diagnosis of normal operation. 14IIJII1
It is a backup system of 41 devices.

Next, the invention of No. 8442 includes, in addition to the outline of the first invention,
Of course, the switching circuit is equipped with an online bus switching section and a day-to-day output section. It is a system.

[Embodiments of the invention]

FIG. 2 is a wg diagram showing an embodiment of the first invention. In the figure, ll#-4 is a regular system control device, that is, a regular system, and 12 is a standby system control device, that is, a standby system.
3 is provided. The regular system 11 always controls the process line during normal operation, and the standby system 12 controls the regular system 11.
The process line is controlled by switching control of a switching circuit 13 which operates in response to a watchdog timer signal generated from the regular system 1 when an abnormality occurs.

The switching circuit 13 performs switching control 1! which is generated from the switching control section 131 that generates the g signal and this switching control section 13 based on the watchdog timer g signal from the regular system 1! Offline bus switching unit 132 that performs switching selection operation upon receiving I number; offline bus switching unit 13
It is composed of 3 and 3. In addition, switching control $131
is usually composed of an IC such as a relay, but each switching section 1
When 32 and 133 use semiconductor switching elements, they are constructed from logic circuits and the like.

Further, at least one online side input/output device 15 is connected to the selection terminal side of the online path switching IA 132. This online side input/output device 15 is
Detection 14116 installed at required points in the process line
and the operating end 17, and these sensing ends 16. It functions as an interface for the operating end 17.

On the other hand, at least one diagnostic human output device 18 is also connected to the selection terminal side of the offline bus switching unit 133. This input/output device 18 is always knee-song, and a load 19 simulating a process is connected as necessary. The online side input/output device 1B,!
... and the diagnostic human output device 18 have different addresses, and communicate with the six human output devices 15..., 18 by specifying the addresses 11, 12, and 18. It is now possible to determine whether the site is online or offline.

Next, the operation of the backup system configured as described above will be explained. First, when the regular system 11 is normal,
Watchdog timer signal WDTMV from regular system 1)
c, the switching control section 131 operates, and each switching section 132,
133 is in the connected state shown in the figure. Therefore, in this state, the online side input/output device 15 is connected to the regular system 11L via the online bus switching section 132, while the diagnostic input/output device 18 is connected to the standby system 12 via the offline bus switching section 133. is connected. Here, the regular system 1 is each online side input/output device 15.・・・
・By specifying the address and communicating with it, we know that it is on the online side, and from this, we take in the process detection signal of the required process line from the human output ei16, perform calculations, obtain operation deba No. 16, and send this to the online side. The IC
It has become.

In the standby system 12, the offline bus switching unit 134'
The standby system 12 is connected to the diagnostic input/output device 18 via r.
- Evening communication is carried out, and through this communication it is determined whether the device itself is on the offline side and whether or not communication can be performed normally, and the input/output device 18 is also diagnosed.

Next, when the regular system 1 becomes abnormal, the watchdog timer 4I! is generated from the regular system 1! The i-th WDTM makes the switching control section 13 inoperable, for example, and thereby the switching sections 132 and 133 are connected to terminals opposite to those shown in the figure. As a result, the standby thread 12 is transferred to the online side input/output device 16 via the online bus switching unit 132.
and the communication with the human output device 15 is 1M [Therefore, it can be seen that it is on the online side and can communicate normally.

On the other hand, the regular system 11 is connected to the diagnostic input/output device 18 via the offline bus switching unit 133, and performs the same operation as the standby system 12 described above.

When repairing or replacing the next IC% regular system 1), the watchdog timer signal WDTM turns on at the same time as the power is turned on and switches the switching parts 132 and 133, so I removed the watchdog timer No. 4118 WDTM line 1g in advance and repaired and replaced it. After confirming that the regular line 1 is normal, connect the watchdog timer line 1M.

Note that since there is no host device, when switching to the standby system 12 or switching from the standby system 12 to the regular system 11VC, the j & new parameters can be given by the operator, or if the input/output devices is and 1stc are stored in advance. Parameters can be updated by reading .

Next, FIG. 3 is a block diagram showing an example of a failure in the invention of m2. In particular, to describe the points that differ from the m2 diagram, information is exchanged with the regular system 1 and the standby system 12, and the watchdog timer 11a of the 6 systems 11 and 12 is exchanged with the host system 2 and the 6 system 11 and 12 from the watchdog timer 11a WDTM An annunciator 22 that notifies abnormalities in systems 11 and 12 is newly provided.

, this host device 21 is connected to each unit 11, 12,
As this connection means, connection is made by a small number of path lines 23 via an upper bus switching section 134 which is switched and controlled by a switching control section 131'. As the switching circuit 13'.

Online bus switching unit 132, offline bus switching unit 1
A digital output switching unit 135 and an on-fin designation switching unit 1364 are provided in 11 of 33, and designation of on-fin or offline is given by a zero level signal of the online designation switching unit 136. The annunciator 22 is configured to perform the operation via the digital output switching section 135. Furthermore, the signal route from the normal system 11 to the switching control section 131' uses a normally closed contact switch 26 and a parallel circuit of self-holding contacts 132 connected in series.

Therefore, according to the configuration of 1 or more, when the normally open contact switch 25 is operated to suppress the normally open contact switch 25 when the normal system JJ is normal, the normal system 1
A watchdog timer signal indicating normality from 1 is input to the switching control unit 131' via the switches 24 and 25,
As a result, each of the switching units 132 to 136 enters the illustrated connection state. Further, the self-holding contact 137 is also closed and remains closed even if the normally open contact switch 25 is restored.

In this state, the regular type 1 is.

When it receives a zero level signal from the online designation switching unit 136 and determines that it is on the online side, it starts communicating with the online side human output device 15 via the online bus switching unit 132, and controls the process line. System 1
can exchange information with the higher-level device 2 via the higher-level bus switching unit 134. This upper level device 2 is 1 normal.

It would be nice to think that it has a CRT and has the function of managing and monitoring the plant, but the 4T has a function to transfer only parameters (if we are limited to it, the upper bus switching unit 13
A dedicated communication line that can be freely communicated with 6 series 11 and 12 without having to have 4 is a type of host equipment 21 that can be used to prepare multiple stations and freely communicate with each other on a dedicated line. It is also possible to use the N communication method.

On the other hand, the standby thread 12 is determined to be on the offline side by the high impedance signal from the online designation switching unit 136, and the standby thread 12 is normally activated by communicating with the diagnostic input/output device 18 via the offline bus switching unit 133. Whether communication is possible or not, and the diagnostic input/output device 18
It is also used to diagnose. Further, a process alarm before the upper/lower limit alarm of the process or a failure of the input/output device 15.18 is sent to the annunciator 22 via the digital output switching section 135.

From here, notifications of failures, etc. are made.

Next, when the regular system 11 becomes abnormal, the watchdog timer signal WDTM indicating the abnormality is sent to the switch 24. Switching side via self-holding contact 137? 111 section 131', and contrary to this, each switching section 132 to 136 is connected in the opposite direction to that shown in the figure, and the self-holding contact 137 is disconnected.
The standby system 12 side vcllilI control takes over. At this time, the operation of the standby system 12 and the regular system 11 is as follows:
This is the same as the regular system 11 and the standby system 12 during normal operation.

Furthermore, when the regular system 11 is repaired or replaced, the self-holding contact 137 is open, so even if the watchdog timer signal WDTM that activates or deactivates the switching control section 131' is output from the regular system 11, the self-holding contact 137 is open. , the contact 137 does not move at all. In this case, the normal state is restored by turning on the normally open contact switch 25. This makes it possible to realize the regular system 1 and the standby system 2 with the same software. It becomes possible. Further, the normally closed contact switch 24 is used when the normal system 11 is forcibly transferred to the standby system 12. That is.

If normally closed contact switch 2a is pressed during operation of normal system 1],
The switching control section 131' becomes inoperable and the self-holding contact 1
37 is opened, and the standby system 12fC secondary control is transferred.
[Effect of the Invention] Therefore, in the first invention, the online side input/output device and the diagnostic input/output are individually connected to the selection terminal side of the online bus switching section that is switched and controlled by the watchdog timer signal 1c. Connect your device.

These two types of input/output devices own different addresses, and 6
Since it is possible to communicate with the system, it has various effects such as first order.

(1) Each unit can easily determine whether it is online or offline by specifying an address and communicating with the online side input/output equipment or diagnostic input/output equipment.

(2) Furthermore, the communication VC between the standby system and diagnostic input/output equipment allows the standby system to diagnose the diagnostic input/output equipment and self-diagnose its own input/output equipment connection interface.

A standby redundant system (iJdljc can be used as above).

(3) Diagnostic human output equipment is the same as the input/output equipment that operates online, and is constantly aging, so it can be replaced every 70 minutes when online input/output equipment breaks down.

(4) When repairing or replacing the normal system, the software for both systems can be made the same if the replacement procedure is such that the switching control section does not operate due to the watchdog timer signal output from the normally closed system.

(5) Therefore, it can be used for various effects such as one or more.

This makes it possible to further improve the operating efficiency of the entire system, including both systems and input/output equipment.

Next VC, in the second invention, an "online designation switching section is provided in the switching circuit, and it is possible to determine whether it is online or offline based on the signal generated by this switching section, and as a result, it is possible to connect online side input/output equipment and diagnostic input. There is no problem even if the address matches the output device, making the system even easier to use.Also, you can select an annunciator when an abnormality or process alarm occurs in the input/output device connected to the online control device. Since it has a digital output switching unit to send to the upper level equipment, it is possible to notify the abnormality of the system fc4.In addition, if you select the system connected to the upper level device using the output of the switching control unit, the higher level The number of connection lines with equipment can be reduced.In addition, a self-holding means is provided between the regular system and the switching control unit, so that the connection is self-maintained only when turned on by human operation. It is possible to use the same software for the regular system and standby system.
Of course, it is also possible to eliminate malfunctions such as when the VC switching control section mistakenly controls the switching of each switching section during repair or replacement.

[Brief explanation of drawings]

Figure 1 is a configuration diagram of a conventional system, Figure 2 is a configuration diagram showing an embodiment of a backup system for a control device according to the first invention, and Figure 3 is a configuration diagram of a backup system for a control device according to the second invention. - It is a configuration diagram showing an example of a system system. 1 No... Normal system (normal system control device), 12... Standby system (standby system control device), 13.13'... Switching circuit,
15゛°° online side input/output equipment, 16...detection end, 17...operation end, 18...human output equipment for diagnosis. 2 no...upper d & instrument, 22... annunciator, 2
5...Push button switch, 131, 131'...Switching + tiU control section, 132...Online bus switching section,
133...Napline bus U1 destination -134...Upper bus switching unit, '135...Digital output switching unit, J36°°° online designation switching unit, 137...Self-holding contact. One applicant: Takehiko Suzue, patent attorney Figure 1 Figure 2 Figure 3

Claims (1)

[Scope of Claims] (11) In a backup system that boots up a standby system control device when an abnormality occurs in the regular system control device, the regular system control device receives a watchdog timer signal output from the regular system control device in response to an abnormality. a switching circuit having an online bus switching section that is switched from the standby system control device to the standby system control device; and an offline path switching section that is switched and controlled from the standby system control device to the regular system control device; and the online bus switching circuit. f'L connected to the selection terminal side of the section,
At least one online side input/output device that functions as an interface between the detection end and the operation end of the process line, which is in communication with each control device described in Section 4iJ. At least one online-side input/output device having the same groove as the online-side input/output device is connected to the selection terminal side of the offline bus switching unit, and functions as a diagnostic device for the standby system control device and the online side input/output device. A backup system for a control device characterized by having a function as a backup device for side input/output equipment. (2) What are the means of communication between each control device and each input/output device? Set up different addresses in advance for the online input/output device and the diagnostic human output device. Each control device specifies the address and communicates 11! possible state it
- A backup system for a control device according to claim 1, wherein the backup system for a control device is configured to determine whether the device is online or offline. (3) Each +ftt control device is able to determine whether it is connected to an online input/output device or an online input/output device using an online designation switching section installed in the support circuit. A backup system for a control device according to claim 1. (4) In a backup system that uses a standby control device to back up when an abnormality occurs in the regular control device, the online bus switching unit that switches from the regular control device to the standby control device and the IC connection for each control device on either the online or offline side. A switching circuit has an online designation switching section that specifies whether the system is in use, an offline switching section that switches from the standby system control device to the active system control device, and a watchdog timer that outputs an output from the system system control device in the event of an abnormality. Once the switching circuit is activated by a signal, the switching circuit is self-maintained regardless of the watchdog timer signal of the regular system control device.A self-holding means is used as a watchbag timer No. 13 output means of the regular system control device. Provided between the switching circuit, connected to the regular system control device and the standby system control device, and connected to the selection terminal side of the online bus switching section and a host device that exchanges information with each control device. and at least one online output device that functions as an interface between the detection end and the operation end of the process line, and =S Online Ul11
At least one offline-side input/output device that is the same as the four human output devices is connected to the selection terminal side of the offline bus switching unit, and the online-side input/output device functions as a diagnostic device for the standby control device. A backup system for a control device characterized by having the function of a pre-vt1 machine. (5) Each control device has an abnormality notification means for notifying the outside of process alarms and failures of input/output equipment, and the offline side of the abnormality notification means of each control device is installed in the digital output switching section in the switching circuit. 5. A backup system for a control device according to claim 4, which is connected to an annunciator that selects an abnormality@I notification means of an input/output device and issues a notification. (6) The self-holding means consists of a normally closed contact switch, a normally open contact switch, and a self-holding contact that operates at the same time as the normal system control device switches to the standby system control device, and the normally open contact is the standby system control device. Forced transfer of Nei control from to the regular control device. A patented backup system characterized in that normally closed contacts are used for forced transfer of control from the regular control device to the standby control device. (The means for connecting the upper device and each control device is one that selectively connects any one control device using a switching control signal from a switching circuit.) Backup system. (8) The backup system for the control device according to claim 4, wherein the connection between the host device and each control device is through a dedicated communication line. (9) The host device is connected to N Each control device consists of N:
Claim 7 or 8, which has a configuration that allows N communication.
Check-up system for the control device described in Section●