JPS61223953A - Multiplexing control device - Google Patents

Abstract

PURPOSE:To execute a control continuously even if a double fault is generated, by providing a bypass function for preventing a signal of a system in which a fault has been generated, from being outputted to a signal selecting logic of a selecting output device. CONSTITUTION:Between plural processors 10 and a process input/output device 20, a signal is sent and received by a series transmission through optical transmission lines 50, 51. A selecting output device 22 selects and generates control output signals Y-Ya from output signals of CPUs 10A-10C transmitted through an input/output signal transmitting device 60, in accordance with a logic of selection/generation of a control output signal corresponding to a combined state of bypass signals 24A-24C from the input/output signal transmitting device 60 of a PI/phi side. This device constitutes a tripling control device, therefore, even if one system becomes a fault, it can be operated by the remaining two normal systems. Even if a new fault is generated in the remaining two systems, the control can be continued by a signal selecting logic of the selecting output device.

Description

[Detailed Description of the Invention] [Field of Application of the Invention] The present invention is applicable to industrial plant control, power generation plant control, etc.
The present invention relates to a control device suitable for plant control that requires high reliability and high availability, and particularly to a so-called multiplex control device in which a plurality of processing devices are installed to execute the same processing.

[Background of the invention]

Traditionally, in control systems that require high reliability and high availability, multiplexed control devices are configured to have dual or triple processing devices and select and generate outputs from those outputs. is applied.

The selection/generation referred to here includes, for example, the process of outputting only one of the systems in a dual system, the process of taking the AND or OR of digital information, the process of selecting high or low values of analog information, It has a meaning that includes majority voting processing of digital information in multiplexing (the logic that performs this is called 2-out-op-3 logic), processing that selects an intermediate value of analog information, etc.

An example of such a multiplexed control device is described in Nikkei Electronics, "Process Control System J with Enhanced Safety through Triplexing," May 9, 1983 issue, pages 185 to 196.

In recent years, serial transmission has been implemented with the aim of reducing the number of cables within a plant. Even in the case of a triplex control system, there is a demand for a device that captures process signals to be installed on-site and to be connected to a centrally located processing device using an optical fiber for serial transmission. However, in conventional triplex control equipment, simply replacing the parallel transmission with optical fiber cables will not work.
This is not sufficient as a triplex control device that requires high reliability and high availability.

FIG. 2 is an example of a conventional triplex control device.

In Figure 2, X-X1! d control input signal, 21 is a distribution input device, IOA, IOB, IOC are processing units (hereinafter referred to as CPU), IOA is A-system CPLI, IO
B is a B-system CPLI, and IOC is a C-system CPLI. Further, 22 is a selection output device, and Y to YthI are control output signals.

The selection output device 22 is A-system CPtJ and B-system CPυ.

It receives the output signals VA, Vl, and We from the C-system cpt+, and then outputs the control output signal Y-Y, 1 according to predetermined selection/generation logic.

The system buses 13X of the three CPU10Xs are connected to the input/output bus 23X via the bus expansion circuit 90X and the bus expansion circuit 92X of the process input/output device 2On. When there are multiple process input/output devices, the bus expansion circuit of the upstream process input/output device is relayed and connected downstream in multiple stages. And bus expansion circuits 90X and 92X, 92X-s and 92X.

It is common that they are connected to each other by conductive wires, and input and output signals are transmitted in parallel.

The operation of this device will be described below. When CPLIIOX takes in the control input signal XX, microprocessor 11X directs bus expansion circuit 90X.

Transmission line 91X1 bus expansion circuit 92X1 person output bus 23X
The input signal data is read through the target distribution input device 21''&.
When the microprocessor 11X outputs the control output signal Y-Y, the microprocessor 11X writes the output signal data to the target selection output device 22 through the same route as the control input signal. .

When accessing the distribution input device or selective output device of the downstream process input/output device 2On, the bus expansion circuit of the upstream process input/output device is used as a relay.

In such a triplex control device, the parallel transmission line 91X
If you simply replace it with a serial transmission line, if a failure occurs in the transmission line, the first problem is that the CPLIIOX processing will stop at the moment the input signal data or output signal data is accessed, and the processing will not be able to proceed forward. There is.

Second, the signal is no longer transmitted to all downstream parts of the system.

Of course, since it is a triple system, control can be continued with the remaining two normal systems for such a single-failure ff (single failer), but there is no problem if the transmission line or processing device of another system When a double failure occurs, such as when a failure occurs, there is a problem in that control cannot be continued.

Conventionally, the device that takes in the signals of one process is housed in the same control panel as the processing device, so failures in the parallel transmission line 92X did not pose a problem. However, when a device for capturing process signals is installed on-site and serially transmitted over a long distance, failures in the transmission line and transmission equipment cannot be ignored.

An example of a triplex control device is Nikkei Electronics, May 9, 1983 issue, p. 185-196, ``Process Control System with Enhanced Safety through Triplex Control''.

[Purpose of the invention]

The object of the present invention has been made in view of the above-mentioned problems, and it is an object of the present invention to provide a multiplex control device that transmits and receives signals between a processing device and an input/output device by serial transmission, which has more fault tolerance and a higher operating rate. We are currently providing multiplex control equipment.

[Summary of the invention]

The multiplexing control device of the present invention has a plurality of processing devices (CPL).
I), a plurality of process input/output devices containing a plurality of distribution input devices and a plurality of selection output devices that exchange signals with the process, and a plurality of process input/output devices that connect the plurality of processing devices and the plurality of process input/output devices. It consists of an optical transmission line. The first feature is that the signal selection logic of the selection output device is provided with a bypass function that prevents the signal of the system in which the failure has occurred from being output.

In other words, majority decision in a multiple system (2 out of 3)
The logic and intermediate value selection logic are
Correct output can be obtained by normal signals from the systems, but if abnormalities occur in both systems at the same time, correct output values cannot be obtained and control cannot be continued. In general, these logics are sufficient when considering only a single fault, but when the first system fails, the output signal selection logic is changed to the normal residual two systems, and the digital information is logically multiplied or °By performing logical OR processing and selecting high or low values for analog information, fail-safe output is performed even when two systems fail at the same time, and system failure does not occur immediately. be able to. Then, when it is detected that two systems are out of order, the signal from the remaining normal system is output as is, thereby making it possible to continue control.

In other words, if it is clear that a t-system has failed, by excluding that system from the selection logic, control can be continued even when the next system fails, making it more fault-tolerant. It can be used as an expensive device.

The second feature is that the optical transmission line for transmitting the input signal and the optical transmission line for transmitting the output signal are provided separately, and the failure signal of the CPU is transmitted via the optical transmission line for the output signal, and further, A means for detecting a failure in the optical transmission path of the output signal and a means for detecting its own failure are provided in the input/output signal transmission device on the process input/output device side, so that not only a failure of the CPU but also a failure of the CPU is detected.
The bypass signal is generated even when there is an abnormality in the transmission system.

The third feature is that by providing an input/output signal data memory in the input/output signal transmission device on the CPU side, the microprocessor in the CPU does not stop operating even if a failure occurs in the transmission system. In addition, the transmission system is configured to be able to perform cyclic transmission at a constant cycle regardless of CPU processing time (generally, the time varies depending on the program of each system to which the triplex control device is applied).

The fourth feature is that the process input/output device is one-on-one with the processing device.
By connecting the process input/output devices facing each other, a failure in the transmission system can be prevented from spreading to other process input/output devices, and the process input/output devices can be decentralized to increase their independence. This eliminates the need to change the cycle of cyclic transmission in the system.

In other words, the third and fourth features are means for easily and simply detecting a failure in the transmission system, which is the second feature.

[Embodiments of the invention]

Hereinafter, the present invention will be explained in more detail with reference to embodiments shown in the accompanying drawings.

FIG. 1 is a block diagram showing one embodiment of the present invention,
The same parts as in the conventional example shown in FIG. It is provided as data that will be used.

Next, the functions of the selection output device 22 of the present invention will be explained.

In the following explanation, in Tables 1 and 2, H level is bypassed and L level is non-bypassed. (still,
(It is clear that the circuit can be configured to correspond to the opposite without changing the gist of the present invention.) The selection output device 22 is connected to the PI/φ side input/output signal transmission device 6.
CPυIOA to IOC transmitted via the input/output signal transmission device 60 according to the logic for selecting and generating control output signals corresponding to the combination state of the bypass signals 24A to 24C from 0 (hereinafter referred to as selection logic). The control output signal Y-Y is selected and generated from the output signals.

Table 1 below shows the selection logic of the selection output device 22 that handles digital information. The digital information referred to here refers to information in which each bit of a binary signal is independent and represents nine pieces of information, for example, information indicating whether an electromagnetic switch is on or off.

There are eight types of combination states of the three bypass signals 24A to 24C as shown in Table 1, and what kind of logic is used in each combination state to determine the CPυ10ANlOC of each group.
output signals vA, vl.

This shows whether the control output signal Y is determined from VC.

In Table 1, the case with number l means that all three bypass signals are non-bypassed, and in this case, Vm vl I is determined by the 2 out of 3 logic.
A majority logic is performed in which a value for which two or more of vC have the same value is set as a control output signal Y. For example, vmu is 1%, vb is 1. When Vc is 0, the control output signal Y is 1.

Next, cases numbered 2 to 40 indicate cases where only one of the three bypass signals is bypassed and the other two are non-bypassed. In this case, the C of the two non-bypassed systems is
A control output signal Y is obtained by performing a logical product or a logical sum on the output of the PLI.

The logical product or the logical sum can be selected by a switch on the selection output device.

Next, cases numbered 5 to 7 indicate cases where two of the three bypass signals are bypassed and the remaining one is non-bypassed. In this case, the non-bypassed CPIJIIO
The output of any one of A to IOC) is selected and becomes the control output signal Y.

Next, case No. 8 shows a case where all three bypass signals are bypass, and in this case, the control output signal Y becomes L level (clear).

Table 2 shows other selection logic of the selection output device 22 that handles analog information.

The selection logic shown in Table 2 selects an analog signal such as a voltage signal or a current signal to be controlled and outputs the control output signal Y from the output device 220.
In addition to being applied when a digital signal representing a quantity in a binary format or the like is required as a control output signal Y.

In the case of Table 2, as in the case of Table 1, logics corresponding to eight types of combinations of bypass signals 24A to 24C are determined.

For number 1, select the one with the intermediate value among the outputs V□, Ml, and vc of the three systems CPLIIOA-10c,
Let it be the control output signal Y. In numbers 2 to 4, one of the low value and high value of the outputs of the two non-bypass systems CP[J is selected and set as the control output signal Y. The low value or high value can be changed by a switch on the selection output device. Numbers 5 to 8 are similar to the digital information selective output device in Table 1 described above.

For the selection output device 22 configured as described above, when a bypass signal is generated due to a failure in the CPU or transmission system and is input as described above, the system is excluded, and the multiplex control allows continuation of control. It is possible to configure the device.

FIG. 3 shows an embodiment of an input/output signal transmission device 30 provided on the CPU unit side.

The human input signal transmitted from the PI/φ side input/output signal transmission device 60 via the input serial signal optical transmission line 50X is an optical/
It is converted into an electric signal by an electric converter 39 and sent to the reception control circuit 3.
6, converted into parallel signals, and temporarily stored. The reception control circuit 36 controls the reception D every time a signal is received.
The MA request redemption code 41 is output to the direct memory access controller (DMAC) 31 to request data collection. The DMAC 31 replaces the microprocessor 32, which had been operating via the internal bus 45 while accessing the memory 33 in which a program indicating the operating procedure of the MPLI 32 is stored.
6 and writes the data into the input/output signal data memory 34. CPL II in Figure 1
The microprocessor 11 of O reads out input signal data from the input/output signal data memory 34 as needed and uses it according to its own program. On the contrary, microprocessor 11
writes the output signal data to be output to the process in the input/output signal data memory 34.

After transmitting the output signal data, the transmission control circuit 37
A transmission DMA request signal 42 is output to the DMAC 31 to request data to be transmitted next. The DMAC 31 replaces the microprocessor 32 with an input/output signal data memory 3.
The data to be transmitted next is read from the transmission control circuit 3.
Send to 7. The signal converted into a serial signal by the transmission control circuit 37 is converted into an optical signal by the electrical/optical converter 40, and sent to the output signal optical transmission line 51X.

The failure signal 15 of the CPLIIO and the signal of the manual bypass switch 44 shown in FIG. When either or both of these signals are 1”, I11#
However, when this is not the case, 0# is written in a part of the input/output signal data memory, and similarly to the output signal, it is transmitted to the PI10 side input/output six input/output signal transmission device 60 via the output serial signal transmission path 51X. Ru.

FIG. 4 shows an embodiment of an input/output signal transmission device 60 provided on the process input/output device I PI10+ side.

The output signal transmitted via the output serial signal transmission line 51X is converted into an electrical signal by the optical/electrical converter 71, taken into the reception control circuit 69, converted into a parallel signal, and temporarily stored. be done. The reception control circuit 69 outputs a reception DMA request compensation code 71 to the direct memory access controller (DMAC) 61 every time a signal is received, and requests data acquisition. The DMAC 61 receives output signal data and CP (J failure signal data) from the reception control circuit 69 in place of the microprocessor 62, which had been operating while accessing the memory 63 in which programs are stored via the internal bus 80. and writes the data into the input/output signal data memory 64.The input/output data transfer control circuit 78 receives the input/output signal data memory 6
The output signal data stored in 4 is sequentially transferred to the corresponding selected output device 22. Conversely, the input/output data transfer control circuit 78 takes in input signals from the distribution input device 21, transfers them to the input/output signal data memory 64, and writes them. After transmitting the input signal data, the transmission control circuit 68 transmits the transmission DMA request signal 70 to the DMAC 61.
output to and then request data to send. DMAC6
1 reads data to be transmitted next from the input/output signal data memory 64 on behalf of the microprocessor 62,
The signal is sent to the transmission control circuit 68. The signal converted into a serial signal by the transmission control circuit 68 is converted into an optical signal by an electrical/optical converter 70, and then sent to the CPU via the human signal transmission circuit 50X.
1O and read by the macroprocessor 11 of CP[J, as described above.

On the other hand, the acPU is stored in the input/output signal data memory 64.
Fault signal data is read from data memory 64 by MPLI 62 and written to status output register 65. and, as its output, the CPLI fault signal 72
is obtained.

On the other hand, the output series signal loss detection circuit 6 which is a feature of the present invention
9 is shown in the time chart of FIG. Every time a serial signal is received from the reception control circuit 69, a reception DMA request signal 71 is output. The output serial signal loss detection circuit 69 takes it in, and outputs an output serial signal loss signal 74 if it is not manually operated for a predetermined period t or more.

At t7t, a failure of the PI 10 side input/output signal transmission device 60 itself is detected by a failure detection circuit of the PI 10 side input/output signal transmission device, which is composed of, for example, a foracchidock timer that detects that the program is not being processed at a constant cycle. 6
6, and a PI 10 side input/output signal transmission device failure signal 73 is output.

The above-mentioned CPU failure signal 72, output serial signal loss signal 74, and PI10 side input/output signal transmission device failure signal 73
is input to a logical sum (OR) gate 76, and a bypass signal 24X is obtained as its output.

Since the triplex control device is configured in this way, if the CPU of one system fails, a CPU failure signal is transmitted via the optical transmission line and a bypass signal is generated, so that the remaining normal parts can be restored. It will be driven by the 2nd series of trains. In this state, the remaining 2
Even if a new failure occurs in the system, control can be continued by the signal selection logic of the selection output device described above.

In addition, if a fault occurs in the input/output signal transmission device on the CPLI side and the serial signal transmission path, it will be detected by the output serial signal loss detection circuit provided in the input/output signal transmission device on the -PI10 side and a bypass signal will be generated. generated. Also, PI10
A bypass signal is also generated by the side output signal transmission device itself, but in these cases, only the relevant process input/output device operates in the remaining two normal systems, and in this state,
Control can be continued even if a new failure occurs in the remaining two systems. Furthermore, failures in these transmission lines and equipment
Since the problem has not spread to other process human output devices and control is being performed as a triple system, this process control device can withstand another double failure.

In addition, for failures in human-powered serial signal optical transmission lines, CPL
I side input/output six input/output signal transmission device detects it, and CPU
By reporting to the internal control program, or by having the triplexed CPUs mutually exchange and compare data (the communication paths between the three CPUs are not shown in Figure 1). , a failure in the input serial signal optical transmission line is found, and at that time, the CPU of the normal system can transfer data to the CPU of the system where the failure has occurred.
Since all three CPLIs can perform calculations normally and generate output signals, the system is configured so that the system will not be bypassed in the event of a failure in the input serial signal optical transmission line. Therefore, in the present invention, the output serial signal transmission line can withstand even another double failure.

Note that the manual bypass switch 44X or 75X is provided to facilitate the recovery of a failed processing device, transmission line, or transmission device.

As mentioned above, in the present invention, by excluding the signal from the failed system from the signal selection logic of the selection output device, it is possible to withstand double failures, and also to make it resistant to double failures. By detecting the occurrence of a failure and actively excluding that system, we can expand the range that can withstand double failures, and further limit the range of influence of a failure in the transmission system to the relevant process input/output device. However, by keeping the signal selection logic in the triple system for the other Prussian input/output devices, greater fault tolerance can be maintained. In addition, by providing separate input serial signal optical transmission lines and output serial signal optical transmission lines, it is possible to preserve greater fault tolerance by not excluding the relevant system in the case of a failure in the former, but excluding it in the case of a failure in the latter. This is what I did.

In the embodiment described above in FIG. 4, the output serial signal loss detection circuit 67 is a dedicated circuit that manually handles the received DMA request signal 71; It's easy to do.

In addition, when the CPU failure signal occurs in Fig. 3, it is assumed that it is transmitted as data in the same way as the output signal.
Even if the transmission of the output serial signal is interrupted when a PU failure signal occurs, the gist of the present invention does not change. However, since the loss detection time is generally set to be longer than the transmission cycle, the bypass signal can be generated more quickly if the data is transmitted as data as shown in FIG.

It is also possible to cyclically transmit a specific code and determine that there is a transmission path failure when the code cannot be received.

In addition, the microprocessor 11X writes data excluding the own system into the input/output signal data memory 34, and the microprocessor 32 logically ORs it with the CPU failure signal 15, etc., and transmits it as data as described above. By doing so, it is also possible to easily bypass the own system from the program running on the microprocessor 11X.

Further, even if the optical transmission lines 50X and 51Xtl are replaced with a series transmission line using conductive wires, the gist of the present invention will not be changed.

〔Effect of the invention〕

According to the present invention, in a multiplexing control device that transmits and receives signals between a processing device and an input/output device by serial transmission, two
It is possible to provide a multiplexed control device that can continue control even if a serious failure occurs, has higher fault tolerance, and has a higher operating rate, which has the effect of contributing to improving the operating rate of the entire system.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing an embodiment of the multiplexing control device of the present invention, FIG. 2 is a block diagram showing an example of a conventional multiplexing control device, and FIG. 3 is a block diagram showing input/output signals on the processing device side of the present invention. FIG. 4 is a block diagram showing an embodiment of the input/output signal transmission device on the process input/output device side of the present invention, and FIG. 5 is a block diagram showing an embodiment of the output serial signal loss detection circuit. A time chart explaining the operation. 10... Processing device (CP[J), 11... Microprocessor? (MP(Jl, 12...Memory, 13...
・System path, 14...CPυ failure detection circuit, 15
... CPU failure signal, 20 ... Process input/output device (PIlo), 21 ... Distribution input device, 22 ... Selection output device, 23 ... Input/output path, 24 ... Bypass signal, 30...CPU side input/output signal transmission device, 31
...Direct memory access controller (
DMAC), 32... microprocessor, 33...
・Memory, 34... Human output signal data memory, 35.
...Status capture register, 36...Reception control circuit, 37
... Transmission control circuit, 38... Human serial signal loss detection circuit, 39... Optical/electrical converter (0/E), 40...
- Electrical/optical converter (glol, 41... Reception DMA request signal, 42... Transmission DMA request signal, 43... Input series signal loss signal, 44... Manual bypass switch, 45... Internal Path, 50... Input serial signal optical transmission line, 51... Output serial signal optical transmission line, 60... PI
10 side input/output signal transmission device, 61... Direct memory access controller + DMACl, 62...
・Microprocessor (MP[J), 63...Memory, 64...I/O signal data memory η, 65...Status output register, 66...PIlO side input/output side residual output signal transmission device failure detection circuit ...Output series signal loss detection circuit, 68...Transmission control circuit, 69...Reception control circuit,
70... Transmission DMA request signal, 71... Reception DMA
Request signal, 72...CPU failure signal, 73...PI
IO side input/output signal transmission device failure signal, 74...Output series signal loss signal, 75...Manual bypass switch, 7
6... Logical sum (OR) circuit, 77... Input/output data transfer control circuit, 78... Internal path, 90... Path expansion circuit, 91 1 Lo packed 2 m ^7-T 8th 3 mouth cruapismV person 7JIfJ11 (#f
1f177 going 1i6y legacy? 1st road zo JゑfiZ 郎ト'84 edict ``hishi 1 favor-εto 1:: 噌r lord, 24X

Claims (1)

[Claims] 1. A plurality of processing devices, a plurality of signal transmission devices that receive output signals from these processing devices and relay the output signals to a selected output device, and a plurality of signal transmission devices. In a multiplex control device comprising a plurality of selective output devices that receive output signals from the plurality of processing devices obtained and output control output signals to a controlled object, each of the plurality of transmission devices has (1 ) a means for detecting and outputting a self-failure and a means for detecting and outputting an abnormality in the transmission line; (2) a bypass for instructing the signal selection generation logic of the plurality of selection output devices in accordance with the signals from these means; a plurality of signal transmission devices each having a first means for outputting a signal; and a plurality of selection output devices comprising a second means for selecting or generating output signals output from the plurality of signal transmission devices according to one logic. Control device. 2. In the multiplexing control device according to claim 1, the input serial signal transmission path and the output serial signal transmission path are provided separately, and a bypass signal is generated in the event of a failure in the output serial signal transmission path, but the input and output serial signal transmission path is A multiplex control device characterized in that it is configured so that a bypass signal is not generated in the event of a failure in a signal transmission path. 3. In the multiplex control device according to claim 1, a memory for temporarily storing input/output signals is provided in the input/output signal transmission device on the processing device side, and a memory is provided between the processing device and the transmission device via the memory. A multiplex control device characterized in that input/output signals are exchanged at the same time. 4. The multiplexing control device according to claim 1, characterized in that a plurality of process input/output devices are connected to the processing device via a transmission path so as to face each other one-to-one.