JPS62204346A - Duplex system switching system - Google Patents

Abstract

PURPOSE:To easily cope even with the dynamic change of a process state by transferring the diagnosis signal for the diagnosis of a primary system in addition to a normal control signal and using the diagnosis signal to attain the quick and accurate diagnosis of troubles of the primary system. CONSTITUTION:The host controller 3A of the primary system performs a process control arithmetic and also produces a synchronizing signal 21. Then the controller 3A produces a test pattern signal 20 based on the signal 21 and transmits it to a standby mode host controller 3B as well as to a duplex system switching device 4 together with the control signal serving as the control arithmetic result as the transmission data. Both the controller 3B and the device 4 receive the transmission data from the controller 3A and produce test pattern signals 22 and 23 through the internal arithmetic and in the same system as the controller 3A based on the signal 21 contained in the received transmission data. Then the deviations delta1 and delta2 from the signal 20 of the primary system are monitored. Thus the abnormality of the primary system is decided when both deviations exceed the abnormality deciding level of the primary system set previously.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a dual system switching system of a dual system hierarchical system consisting of two upper level control devices and a plurality of lower level control devices.

[Conventional technology]

In relatively large-scale control systems, the control processing functions are hierarchically decentralized in order to improve controllability, and control of the entire control system is performed by a higher-level control device, while direct control of processes is distributed to each function. Hierarchical systems using multiple lower-level control devices are widely used. In this case, in order to improve reliability, it is necessary to duplicate the upper control device that performs important processing.

Regarding the switching of the duplicated host controllers, conventionally, as described in Japanese Patent Laid-Open No. 56-7154, the standby host controller performs the same control calculations as the main host controller. A mutual diagnosis function that compares the system control calculation results and determines that the main system is abnormal when the deviation exceeds the specified upper and lower limits, and a mutual diagnosis function that allows lower-level control devices to receive control signals from higher-level control devices and detect the control signals. A combination of three diagnostic functions: an abnormality detection function that checks the upper and lower limits of the upper and lower limits and rate of change, and determines that there is an abnormality in the main host controller when either exceeds a specified value, and a self-diagnosis function for the main host controller. Therefore, a wired logic logic judgment processing circuit is provided outside these upper control devices and lower control devices as a circuit dedicated to switching the dual system to perform switching from the main system to the standby system.

[Problem that the invention seeks to solve]

In the above-mentioned conventional technology, since both the mutual diagnosis function and the abnormality detection function are diagnosed using the control signal of the main system, in the case of a sudden change S in the process (for example, PCB in thermal power plant control, load runback, etc.), Since the control signal also changes suddenly, there is a possibility that the rate of change will be abnormal or the control signal deviation will be large temporarily, leading to a misjudgment as a main system abnormality.To prevent this, limiting the range of abnormality judgment may have the opposite effect. There has been a problem that abnormality determination is omitted or abnormality determination is delayed.

One aspect of the present invention is to send and receive diagnostic signals for main system diagnosis in addition to normal control signals, and use this to quickly and accurately diagnose faults in the main system. It is an object of the present invention to provide a dual system switching system that can easily respond to changes.

[Means for solving problems]

Two higher-level control devices and multiple lower-level control devices that make up the main system and standby system are connected via a transmission line, and one or more of the lower-level control devices is used as a dual system switching device, and the main The system transmits a main system test pattern signal for abnormality diagnosis and a synchronization signal for creating the test pattern together with a control signal as transmission data to the standby system and the dual system switching device. In the standby system and dual system switching device, a standby system test pattern signal is created using the synchronization signal, and the deviation between this signal and the main system test pattern signal is monitored, and if the deviation is above a certain value, the main system abnormality is detected. I judge that.

By performing abnormality diagnosis using this test pattern signal, it is possible not only to detect abnormalities in the main system control processing regardless of the process control status of the control device, but also to detect abnormalities in the main system as a whole, including abnormalities in transmission processing or transmission hardware. can be determined.

With the above abnormality diagnosis function, in the dual system switching device,
Main system diagnosis results of standby system, dual system switching system, i! If the main system diagnosis results for both main systems are abnormal, double system switching can be performed by transmitting a switching command from the main system to the standby system to the upper control device and each lower control device. The above objectives are achieved.

[Effect]

The switching logic of the dual system switching device uses a method in which dual system switching is performed only when the main system diagnosis of the standby system and the main system diagnosis of the dual system switching device both determine that the main system is abnormal.

As a result, unless there is a double failure in which both the standby system and the dual system switching device make a false diagnosis, malfunctions will not occur. Normally, in a dual system, in the event of a double failure, protective devices, etc. The structure is such that a safe stop is performed at the stage.

〔Example〕

An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 shows a system configuration diagram illustrating an embodiment of the present invention.

This figure shows the overall configuration of a control device that performs process control, and a plurality of systems (control device group) from 2-1 to 2-m are connected via an upper transmission line 1.

Here, the system 2-1 is the upper control device 3ACA system), 3
B (B system), lower-level control devices 4.5-1 to 5-n, and lower-level transmission line 6 (hereinafter abbreviated as transmission line); The control device 4 is
It is a lower control device and also operates as a dual system switching device.

Upper control units [3A and 3B are both capable of operating as either the main system or the standby system, and each has a test pattern generation/verification circuit 7 for determining abnormality in the main system and a main system/standby system operation switching circuit 8. .

In addition, each lower control device [4, 5-1 to 5-n] selects and receives transmission data on the main system side among the upper control devices 3A and 3B, and also receives data for receiving the main system diagnosis result on the standby system side. It has a receiving circuit 9, and in particular, the dual system switching device 4 has a test pattern matching circuit 10 for determining an abnormality in the main system and a dual system switching circuit 11, and also has an abnormality reset switch 14 as a process input for manual operation. It has an apparatus 12 and a process output device 13 for outputting main system control stop commands 15A and 15B when it is determined that there is an abnormality in the main system. System a2-2~2-m
is the same as system 2-1 and will be omitted.

Dual system switching in a state where the host controller 3A operates as the main system and 3B operates as the standby system will be described below.

FIG. 2 shows the principle of main system abnormality diagnosis using test pattern signals. The main host controller 3A performs process control calculations and creates a synchronization signal 21.Based on this, a test pattern signal 20 is generated, and the standby host controller 3B generates the test pattern signal 20 together with the control signal that is the control calculation result as transmission data.
and is transmitted to the dual system switching device 4. The standby system upper control device 3B and the duplex system switching device 4 receive 3A of transmission data from the main system upper control device, and among these, the synchronization signal 2
1, the upper control unit of the main system generates test pattern signals 22 and 23 by internal calculation in the same manner as 3A, and generates test pattern signals 20 and 23 from the main system, respectively.
The deviations δl and δ2 are monitored, and the deviations δ1. When δ2 becomes equal to or greater than a preset main system abnormality determination value, it is determined that there is a main system abnormality.

FIG. 3 shows the configuration of a dual switching transmission system via the transmission line 6.

The main host controller 3A performs control calculations based on the process data, and uses the test pattern generation and verification circuit 7 to create a test pattern signal 20 and a synchronization signal 21 as shown in FIG. The test signal area 34 of the transmission frame 30A, which is the unit of A system/B system identification flag area 32
is set and sent to the transmission line 6 as the main system transmission data 43 together with other transmission data 40A which is a control signal to the standby system 3B and the lower control devices 4.5-1 to 5-n based on the control calculation result.

On the other hand, the standby system upper control device 3B performs control calculations based on process signals and control signals from the lower order control device, and also performs control calculations based on the synchronization signal 21. in the transmission data 43 from the main system. Using the test pattern signal 20 and the A system/B system selection signal 45 from the dual system switching system [4], the test pattern generation/verification circuit 7 and the main system/standby system operation switching circuit 8 diagnose the main system abnormality. conduct. The diagnosis result is stored as the main system diagnostic flag 41 in the main system diagnostic flag storage area 33 in the transmission frame 30B, and like the main system, the dual system data flags 31 and 3B (B
A flag indicating that the data is system A/B system data is set in the A system/B system detailed flag area 32, and is sent to the transmission line 6 as standby system transmission data 44 together with a control signal 40B based on the control calculation result.

In contrast, the lower control units [4, 5-1 to 5-n] are selected from the main system by the data receiving circuit 9 according to the A system/B system selection flag 36 indicating that the A system is the main system. The transmission data 43 is received, the data is stored in the upper control device data reception area 39 in the data area 35, and the standby system transmission data 44 from the B system is received, and the main system abnormality flag 41B is
is the A system abnormal flag (here, the A system is the main system)
The control signal 40B is set in the area 37 and the control signal 40B is discarded. B
When the system is the main system, the same processing is performed on the data transmitted from the A system, and the main system diagnostic flag is set in the B system abnormality flag area 38.

In addition, the dual system switching device performs control calculations using the process signal and the control signal 40A from the main system's higher-level control device, and also performs control calculations using the test signal data 34 in the main system transmission data 43.
If this result and the main system diagnosis result of the standby system, that is, the A system abnormality flag 37, both indicate a main system abnormality, the dual system switching circuit 11 Then, the B system selection flag 45 (a flag for switching the B system from the standby system to the main system) is set in the A system/B system selection flag 36, and this is sent to the host controller 3 via the transmission path 6.
A, 3B and other lower control devices 5-1 to 5-n are notified.

As a result, the main system/standby system of the host controllers 3A and 3B is reversed, and the test pattern generation/verification circuit 7 and the main/standby system operation switching circuit 8 change the A system: standby system and the B system: main system, respectively. At the same time, the lower control devices 5-1 to 5-n, which have received an instruction to switch to the B system as the main system by the dual system switching device and the B system selection flag 45 from the device, thereafter switch to the B system. It receives transmission data 44 as main system data, and performs predetermined control calculations in accordance with control signal 40B.

In the transmission system as described above, dual system switching is performed via the transmission path 6, and the processing contents of the data receiving circuit 9 included in the lower control devices 4.5-1 to 5-n are shown in FIG.

In other words, the data receiving circuit 9 uses the duplex data flag 31 of the received data to determine whether the duplex data determination unit 51 determines duplex data (transmission data from a higher-level controller having a duplex configuration).
If it is not duplex data (that is, if it is data transmitted from a lower control device), the data reception processing unit 59 receives the data.

On the other hand, in the case of dual system data, the A system/B system identification flag 32
From this, the A system/B system data determining unit 52 determines whether the system is A system or B system, and in the case of B system data, the main system diagnosis determination unit 53 of the B system determines that the A system is abnormal based on the main system diagnosis flag 41. If there is an abnormality, the A-system abnormality flag setting section 54 sets a flag in the A-system abnormality flag area 37.

Also, based on the A/B selection flag 36, the Japanese selection identification unit 5
5, it is determined whether the main system is the B system or not. If the B system is selected, the data reception processing section 59 receives data from the B system.

In the case of data from the A system, the main system diagnosis determination unit 56 of the A system,
Similar reception processing is performed using the B-system abnormality flag setting section 57 and the A-system selection identification section 58.

Next, the main system/standby system operation switching circuit 8 and the test pattern generation/verification circuit 7 built in the host control devices 3A and 3B will be explained using FIG. 5 and FIG. 6, respectively.

FIG. 5 shows the main system/standby system operation switching circuit, and the own system state 61 is set to standby by the A system/B system selection flag 45 received from the dual system switching device 4 as a process common to the main system and standby system. System a
In the case of tO#l and in the self-diagnosis abnormal state 62, various methods such as transmission timer monitoring are generally used as the abnormality detection method, but these are omitted here. The reset condition for the flip-flop 65 is established by the logic inversion element +83 and the OR element 64, and the logic inversion element 66
As a result, the mode 67 is set in which transmission to the upper transmission path 1 is prohibited.

On the other hand, self-system state 61 is the main system, and self-diagnosis abnormal state 6
If it is not 2, the transmission prohibition mode 67 to the upper transmission path 1 is canceled.

Further, in the case of self-diagnosis abnormality 62, the transmission prohibition mode 68 is also set to the lower transmission line 6.

In addition, in the standby system, if the result of the main system diagnosis in the test pattern generation/verification circuit 7 (described in detail later) is that the main system test pattern is abnormal 83, the flip flop 69
Main system error flag 41B (41A if B system is the main system)
).

This flag is used in the case of self-diagnosis abnormality 62, or in the case of not main test pattern abnormality 83 and abnormality reset 14, logic inversion element, child 70. It is canceled using an AND element 71 and an OR element 72.

Next, the main system and standby system test pattern generation/verification circuits will be explained using FIG.

When the own system status 61 is main system "1", the output of the synchronizing signal generation circuit 85 is selected by the signal switch 84 and becomes the input of the test pattern generation circuit 87.

The test pattern generation circuit generates a sawtooth test pattern signal 20 based on the synchronization signal input 86,
a synchronization signal 21 which is the output of the synchronization signal generation circuit 85;
and is sent to the standby system and dual system switching device.

On the other hand, in the standby system, the own system status 61 becomes "0", and the signal switch 84 selects the main system synchronization signal 21 transmitted from the main system as described above.

Based on this, a test pattern signal similar to the main system is generated in the test pattern generation circuit 87, and this signal and the main system test pattern signal 20 sent from the main system are input to the deviation monitor 88, so that the deviation reaches the specified value. It is monitored whether or not it exceeds this, and if it exceeds this, the main test pattern abnormality flag 83 is set by the logic inversion element 89 and the AND element 90.

Next, regarding the dual system switching circuit 11 and the test pattern matching circuit 10 built into the dual system switching device.

This will be explained using FIG. 7 and FIG. 8, respectively.

When considering the state in which system A is the main system, in Figure 7,
These are the output of the main system (A system) abnormality flag 41B of the B system, which is the standby system, and the test pattern matching circuit 10. When the A-system test pattern abnormality flags 101A are both on, the flip-flop 103A is set through the AND element 102A, and the A-system/B-system selection flag 45 is set to select the B-system through the flip-flop 104A and logic inversion element 105A. state.

Furthermore, by setting the A-system abnormality flag 106A, the CPU (central processing unit f) of the upper control device 113A (A-system) is
) to stop.

Similarly, in the case of a state where system B is the main system, the main system of system A (
B system) abnormality flag 41A, B system test pattern abnormality flag l0IB, AND element 102B.

Dual system switching is performed using the flip-flop 103B, and when the B system abnormality flag 106B is set, the host control device 3
Stop the CPU of B (B system).

In addition, the A-system abnormality flag 106A and the B-system abnormality flag 10
6B can be reset by an abnormality reset request 14. Next, the test pattern matching circuit 10 of the multiplex switching device 4 will be explained with reference to FIG.

In the dual system switching device T14, a test pattern is generated based on the synchronization signal 21 sent from the main system.

The circuit 121 generates a main system test pattern signal, and uses this signal and the main system test pattern signal 20 sent from the main system as input to a deviation monitor 122 to check whether the deviation exceeds a specified value. If this value is exceeded, using the AND elements 123 and 124, the A system/B system selection signal 45 is used to set the A system test pattern abnormal flag l0 when the A system is selected.
When IA, B system is selected, B system test pattern abnormality flag 1
Set 01B.

Using these diagnostic signals, the dual system switching process is performed as shown in FIG. 7 above.

In this embodiment, a specific example of configuring one dual system switching device was described, but if multiple systems are installed for the purpose of improving reliability, the output from each dual system switching device is Functions such as logical product (to prevent malfunction), logical sum (to prevent malfunction), and majority logic (to improve reliability of dual system switching signals) of the A system/B system selection signals to be applied should be provided according to the applied system. This can be easily accommodated by

〔Effect of the invention〕

According to the present invention, it is possible to quickly and accurately diagnose abnormalities in the main system without being affected by dynamic fluctuations in process conditions.

Furthermore, by performing the main system diagnostic judgment comparison and switching from the main system to the standby system via the transmission path, the hardware for dual system switching can be eliminated or greatly simplified.

[Brief explanation of drawings]

Fig. 1 is a control system configuration diagram of an embodiment of the present invention, Fig. 2 is the principle of main system abnormality diagnosis using test pattern signals, Fig. 3 is a dual system switching transmission system, and Fig. 4 is a subsystem control system configuration diagram. Data reception processing of the control device, Fig. 5 shows the main system/standby system operation switching circuit of the host control device, Fig. 6 shows the test pattern generation/verification circuit of the host control device, and Fig. 7 shows the dual system switching circuit. FIG. 8 shows a test pattern matching circuit of the dual system switching device. 3A, 3B...Upper control device, 4...Double system switching device (lower control device) 5-1. ~5-n... Lower control device, 7... Upper control device test pattern generation/verification circuit, 8... Upper control device main system/standby system operation switching circuit,
9... Lower control device data receiving circuit, 10... Dual system switching device test pattern matching circuit, 11... Dual system switching device Dual system switching circuit 6

Claims (1)

[Claims] One or two higher-level control devices and a plurality of lower-level control devices are connected via a transmission line, and the two higher-level control devices each calculate and output a control command, and the plurality of lower-level control devices In a hierarchical distributed control system in which the lower-level control device receives control commands from the higher-level control device selected as the main system and performs respective controls, at least one of the plurality of lower-level control devices has the dual control device. A system switching function is provided to make this a dual system switching device, and the control command is added to the data transmitted from the main system side upper control device to the standby system side upper control device and the dual system switching device. By transmitting data and comparing the main system diagnostic data generated by the standby side upper control device and the dual system switching device with the diagnostic data transmitted from the main side upper control device, mutual diagnosis means between the two host control devices and main system abnormality detection means in the dual system switching device for the two host control devices; Accordingly, the dual system switching system is characterized in that switching is performed from the main system higher-level control device to the standby system higher-level control device. 2. In the dual system switching system described in claim 1, a synchronization signal that turns on and off at regular time intervals and a test pattern signal that changes over time based on the synchronization signal are used as the diagnostic data, and In the standby system upper control device and the dual system switching device, the synchronization signal is received, and based on this, a signal is generated in the same manner as the test pattern signal generation in the main system upper control device. A main system abnormality diagnosis determination function is provided which calculates a deviation between the test pattern signal and the main system diagnostic data as system diagnostic data, and determines that the main system is abnormal when the deviation exceeds a preset value. Dual switching system.