KR101438124B1 - Dual control apparatus based on field programmable gate array and dual change method - Google Patents

Abstract

An FPGA-based redundancy control device and a redundancy switching method applied to a nuclear measurement control system are disclosed. According to the embodiments of the present invention, even if a failure occurs in one FPGA board among the duplicated FPGA controllers, it is possible to easily determine whether a failure has occurred according to whether a beating signal is transmitted or not, The operation can be maintained. In addition, when applied to a nuclear power plant measurement control system, it can be replaced with an analog and DSP (Digital Signal Processor) board to perform the main operation function, and the utilization of the control device is further improved by using the redundant FPGA.

Description

BACKGROUND OF THE INVENTION Field of the Invention [0001] The present invention relates to a dual-

The present invention relates to an FPGA-based redundancy control apparatus and a redundancy switching method applied to a nuclear power system control and control system.

Field Programmable Gate Array (FPGA) technology is used in many industrial applications. Instrumentation and control equipment for nuclear power plants uses analog and DSP (Digital Signal Processor) based technologies.

On the other hand, the analog-based measurement and control system used in the conventional nuclear power plant was required to be repaired and replaced due to the deterioration of parts. Due to the difficulty of technical support and procurement of parts for such a demand, it is difficult to continue use of analog devices, and it is difficult to maintain and repair the conventional nuclear measurement control system.

An FPGA-based controller has been developed to replace the analog-based instrumentation control system. As shown in FIG. 1, the FPGA-based controller includes an input board for processing input signals in the field, an FPGA board for implementing control functions, an output board for processing signals output to the field, . These FPGA-based controllers implement on-site control functions through software, so they can flexibly implement on-site functions and have superior data transmission, processing, storage capability, and accuracy compared to analog-based technologies.

Thus, embodiments of the present invention implement a control device having a redundant backplane structure and an FPGA structure, so that even when a failure or an error occurs in the configuration of one FPGA board, another redundant FPGA board detects the same and performs the same functions and operations And to provide a duplication control device and a duplication switching method based on an FPGA applied to a nuclear power control control system.

An FPGA-based duplication control apparatus according to an embodiment of the present invention includes a signal input / output unit for receiving or outputting a signal through a data bus provided in a redundant backplane; A redundant first FPGA board and a second FPGA board; And a redundancy switch signal processor for performing redundancy switching in a state where the second FPGA board is switched to perform the function and operation of the first FPGA board when the beep signal is not applied, Each of the 2 FPGA boards includes a first operational FPGA implemented with an FPGA device that performs a main arithmetic function to control the instrumentation control system of the nuclear power plant to generate one or more output data and periodically generate a beating signal; An FPGA device which does not provide the beating signal to the second FPGA board while monitoring the beating signal transmitted from the first calculating FPGA and judges whether or not a failure of the first calculating FPGA occurs, And a first monitoring FPGA implemented as a first monitoring FPGA.

In one embodiment, the duplication control apparatus comprises: a heartbeat signal transfer bus independently of the data bus on the redundant backplane, for transferring the beating signal between the first FPGA board and the second FPGA board; And further comprising:

In one embodiment, the bus module of the duplicated backplane is characterized by comprising a 32-bit sized doubled data bus and a bus for transmitting an 8-bit sized heartbeat signal.

In one embodiment, the heartbeat signal transmission method uses an SPI (Serial to Parallel Interface) method.

In one embodiment, the first monitoring FPGA monitors the beating signal transmitted from the first calculating FPGA, and if the beating signal is not transmitted for a predetermined time, it is determined that the first calculating FPGA has failed, And does not provide the beat signal.

In one embodiment, the duplication control apparatus further comprises a redundant power supply unit for supplying power to at least one of the first calculation FPGA, the first monitoring FPGA, and the duplication switching signal processing unit.

In one embodiment, the first monitoring FPGA further includes a monitoring timer, which is received in the first monitoring FPGA, and the monitoring timer is operable when the beating signal is not input for a predetermined time, And a stop signal is generated.

In one embodiment, the first monitoring FPGA does not provide the beating signal to the second FPGA board when a stop signal of the first calculating FPGA is generated.

In one embodiment, the duplication control apparatus includes: a signal processing unit for providing a signal based on the generated output data to the signal input / output unit; The first monitoring FPGA further includes a self-diagnosis function for comparing the signal with a feedback signal to determine an error or a failure of the signal input / output unit.

In one embodiment, the duplication control apparatus further includes an internal memory for storing a signal of the signal input / output unit, and the first operation FPGA generates the output data using a signal stored in the internal memory .

In one embodiment, the signal is an analog signal or a digital signal, and the signal input / output unit receives the analog signal or the digital signal from a measurement control system of a nuclear power plant.

In one embodiment, the signal is an analog signal or a digital signal, and the signal input / output unit outputs the analog or digital signal to the measurement control system of the nuclear power plant.

In one embodiment, the system further includes a status indicator that indicates a normal operating state or a failure state of the first operational FPGA based on the beating signal.

Also, a redundant transfer method of an FPGA board according to an embodiment of the present invention is a redundant transfer method of a redundant FPGA board for receiving or outputting a signal through a data bus of a redundant backplane, Performing a main arithmetic operation function and periodically outputting a pulse signal; Monitoring a beating signal transmitted from the first computing FPGA by a first monitoring FPGA of the first FPGA board and determining whether the first computing FPGA has failed based on the monitoring result; The first monitoring FPGA of the first FPGA board informs the second monitoring FPGA of the second FPGA board of the start of the redundancy transfer without providing the beating signal to the second FPGA board when a failure occurs in the first calculating FPGA Wow; Performing redundancy switching of the first FPGA board and the second FPGA board in a state where the first operation FPGA of the second FPGA board is switched to perform the function and operation of the first operation FPGA of the first FPGA board; And a control unit.

In one embodiment, the method further comprises transmitting the beating signal between the first FPGA board and the second FPGA board through a beating signal transmission bus independently provided in the redundant backplane.

In one embodiment, the step of determining whether or not the fault has occurred may include determining that a fault has occurred in the first operation FPGA if a beep signal is not transmitted from the first operation FPGA for a predetermined time.

According to the FPGA-based redundancy control device and the redundancy switching method according to the embodiment of the present invention, even if one FPGA board among the redundant FPGA control devices fails, the failure is easily determined according to whether the beating signal is transmitted, So that normal operation can be maintained by the other FPGA board.

Further, according to the FPGA-based redundancy control device and the redundancy switching method according to the embodiment of the present invention, when applied to a nuclear power plant measurement control system, it is possible to perform a main calculation function that can replace the DSP (Digital Signal Processor) The utilization of the control device is improved by using the FPGA.

1 is a block diagram showing a configuration of a general control device applied to a nuclear power system control system;
FIG. 2 illustrates an example of a platform configuration of a dual control device based on an FPGA according to an embodiment of the present invention; FIG.
FIG. 3 is a diagram schematically illustrating a signal transmission / reception structure between redundant FPGA boards according to an embodiment of the present invention; FIG.
4 is a block diagram showing a detailed configuration of a single FPGA board in a duplication control apparatus according to an embodiment of the present invention;
5 is a schematic diagram illustrating the structure of a duplexed backplane according to an embodiment of the present invention;
6 is an exemplary flowchart of a redundant switching method of a redundant control device based on an FPGA according to an embodiment of the present invention.

Hereinafter, an FPGA-based redundancy control apparatus and a redundancy switching method applied to a nuclear power system control and control system according to embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, a redundancy controller based on an FPGA according to an embodiment of the present invention includes a signal input / output unit for receiving and outputting a signal through a data bus provided in a redundant backplane, a redundant first FPGA board and a second FPGA board And a redundancy switching signal processor for performing redundancy switching in a state where the second FPGA board is switched to perform the function and operation of the first FPGA board if a beating signal is not provided from the first FPGA board.

Each of the first FPGA board and the second FPGA board includes an operation FPGA and a monitoring FPGA. The operation FPGA performs a main operation function to control the measurement control system of the nuclear power plant to generate one or more output data, The monitoring FPGA monitors the beating signal transmitted from the computing FPGA to determine whether the computing FPGA has failed or not, and when the failure occurs, the beating signal is provided to the second FPGA board It is desirable to implement an FPGA device that does not use the device.

2 is a diagram illustrating a platform configuration of a dual control device based on an FPGA (Field Programmable Gate Array) according to an embodiment of the present invention.

The redundant control device 200 includes a redundant backplane bus, a redundant power supply module 210, a redundant FPGA control board 220, a communication board 230, and a plurality of analog and digital input / output boards 240, .

The FPGA control board 220 mounted on the redundant control apparatus 200 has a main operation function for controlling the measurement control system of the nuclear power plant, a self diagnosis function, a bus module control function, a rack internal communication and a CRC- Function. In addition, the FPGA control board 220 performs a monitoring function for monitoring a failure or an error of each of the components installed in the duplicated control device 200 and a redundancy switching function when one FPGA control board 220 operates in an abnormal state .

The redundant power supply module 210 is implemented such that when one power supply module fails to supply power to the configuration of the redundant control device 200, the other power supply supplies power to each configuration .

5 schematically illustrates a structure 100 of a redundant backplane according to an embodiment of the present invention. As shown in FIG. 5, the buses of the duplicated backplane have independent structures in which the data buses and the beating signal transmission buses 10a and 10b are respectively duplicated. As a result, if one backplane bus fails or fails, normal operation is achieved through the other backplane bus. In an embodiment, the data bus of the duplicated backplane occupies 32 bits each and the bus for transmitting the pulsatile signal of the duplicated backplane is implemented as a bus module occupying 8 bits each. In addition, the redundant data bus and the redundant beacon signal transmission bus are independently provided in hardware.

The dual FPGA control board 220 includes a computational FPGA and a monitoring FPGA, respectively. At this time, the arithmetic FPGA performs a main arithmetic operation to control the measurement control system of the nuclear power plant to generate one or more output data and periodically generate a beating signal. In addition, the monitoring FPGA monitors the beating signal transmitted from the operation FPGA, and determines whether or not a failure has occurred in the operational FPGA by monitoring the beating signal, 220).

Here, the operational FPGA and the monitoring FPGA are preferably implemented as FPGA devices.

A plurality of analog and digital input / output boards 240 receive and output signals through the data bus of the redundant backplane. At this time, the analog input / output board includes an analog / digital converter and a digital / analog converter, and the digital input / output board is composed of a phototransistor.

In addition, the plurality of analog and digital input / output boards 240 perform a preprocessing function and a post-processing function, for example, for an output voltage signal. In addition, the plurality of analog and digital input / output boards 240 include self-diagnostic functions and include redundant circuitry and / or feedback circuitry for each input / output channel.

FIG. 3 is a diagram schematically illustrating a signal transmission / reception structure between redundant FPGA boards according to an embodiment of the present invention. Referring to FIG. In the embodiment of the present invention, the first and second FPGA boards perform the same function. At this time, if a failure or an error is detected in one of the FPGA boards, the other FPGA board is replaced, performing the same function, and performing redundancy switching for the failed or error-detected FPGA board.

Transmitting and receiving signals between the redundant FPGA boards is done through the bus for transmitting the pulses of the redundant backplane. That is, the output data generated by the operation FPGA performing the main operation function in the first FPGA board may be post-processed in the signal processing unit (not shown) and provided to the signal input / output unit. Also, the monitoring FPGA performing the monitoring function in each FPGA board compares the signal with the feedback signal and performs a self-diagnosis function to determine whether the signal input / output unit has an error or a failure.

Also, the redundant FPGA board sends and receives beats to each other to detect a failure or an error in one of the FPGA boards. More specifically, the beating signal periodically generated from the operation FPGA performing the main operation function in each FPGA board is transmitted to the monitoring FPGA performing the monitoring function. At this time, the heartbeat signal is not transmitted to the monitoring FPGA performing the monitoring function in case of a failure in the operation FPGA performing the main arithmetic function. If the heartbeat signal is not delivered for a certain period of time, it is determined that a failure has occurred.

In order to perform this monitoring function, the monitoring FPGA performing the monitoring function can receive the monitoring timer inside. The monitoring timer generates an operational FPGA stop signal if the beating signal is not input for a predetermined time. Operation When the FPGA is stopped, the supervisory FPGA performing the supervision function allows the other FPGA board to perform the redundant transfer without generating the beating signal.

On the other hand, the beating signal delivered to the surveillance FPGA performing the monitoring function is transmitted to the other FPGA board through the bus for transmitting the beating signal of the redundant backplane. That is, the first FPGA board and the second FPGA board periodically transmit and receive the beating signal through the bus for transmitting a beating heart signal. If a beep signal is not received from another FPGA board for a certain period of time, it is determined that a failure has occurred as described above.

At this time, a signal for performing a redundancy switching function due to a failure is processed in a redundant switching signal processor, and is transmitted to another FPGA board through a dual-purpose pulse signal transmission bus. Here, the dual-purpose beep signal transmission bus is provided independently of the other data buses in the redundant backplane.

In an embodiment, the pulse signal transmission method preferably uses an SPI (Serial to Parallel Interface) method.

Meanwhile, if the beep signal is not received for a predetermined time, the monitoring FPGA performing the monitoring function transmits a signal for forcibly stopping the operation of the operational FPGA determined to have failed. The result of the processing is transmitted to the redundant switch signal processor, and the redundant switch signal processor determines whether the received signal is erroneous and transmits a redundant switch start command to another FPGA board. At this time, the duplication transfer initiation command may be transmitted through a bus for transmitting a dual pulse signal.

In the embodiment of the present invention, each of the duplicated FPGA boards performs a main arithmetic function and further performs a self diagnosis function of Table 1 shown below. At this time, if an error occurs through the self-diagnosis function, an error is notified by not providing a beating signal to the other duplicated FPGA board, and the other duplicated FPGA board is replaced with an FPGA board judged as an error , The same function and output signal. At this time, as described above, buses for transmitting beep signals independently configured from the data buses for data transmission are provided in the redundant backplane between the redundant FPGA boards.

number
board
Diagnostic function
Detected errors
Detection method
One FPGA board
Monitor FPGA health during operation
Heartbeat signal error,
Operation FPGA failure
Watchdog Timer
2 FPGA board,
Communication board Active
Data integrity (CRC-CCITT) monitoring
Communication error
Performing cyclic redundancy check (CRC-CCITT)
3 FPGA board,
Communication board,
Various input / output boards
Check FPGA board memory during operation
Memory Low Power
Under-voltage monitoring of the board
4 FPGA board
Check operation status of each board in sub rack during operation
Beep signals and backplane communications from each board Abnormal operation (failure)
Verification of beats of each board by FPGA board 5 Communication board (CMB)
Monitoring communication (Ethernet, RS-422) and data integrity (CRC-CCITT)) during operation
Communication error Performing cyclic redundancy check (CRC-CCITT)

Hereinafter, a detailed configuration of a single FPGA board of the duplication control apparatus will be described with reference to FIG. As shown, a single FPGA board includes an operational FPGA that performs the main arithmetic function, a monitoring FPGA that performs monitoring functions based on the beating signal, an internal memory, a buffer, a rectifier filter, a regulator, a converter, A backplane for connection to another FPGA board, and a status indicator.

The internal memory stores the digital value of the input signal and stores the output data generated by the operational FPGA. Also, the internal memory stores all data in a duplex manner so as to check the integrity of the memory.

The operational FPGA and the monitoring FPGA are implemented as a programmable logic device and perform the following operations.

The operation FPGA generates one or more output data using signals stored in an internal memory. Further, the operation FPGA stores the generated output data in the internal memory. The monitoring FPGA monitors a beating signal transmitted from the computing FPGA and performs a monitoring function to determine that a failure has occurred in the computing FPGA if the beating signal is not transmitted for a predetermined time. Also, the monitoring FPGA performs redundancy switching between the FPGA boards when a failure occurs.

The status display unit displays the status of the input signal and the output signal, and has an LED for indicating whether or not the beep signal is transmitted and the occurrence of the failure. In addition, the LED may indicate two or more colors so as to discriminate between the normal or abnormal state of the input / output signal and whether the normal or abnormal state beating signal is transmitted and the normal or abnormal state of the operational FPGA performing the main operation function.

Converters (ADCs) and converters handle analog and / or digital signals that are input or output.

Hereinafter, with reference to FIG. 6, an exemplary procedure of a duplication switching method of a duplicated control apparatus according to an embodiment of the present invention will be described. Here, the redundant control apparatus according to an embodiment of the present invention is configured to transmit and receive one or more signals through a data bus independently provided in a redundant backplane structure, so that even when one backplane data bus fails, Normal operation is performed.

First, the first arithmetic FPGA of the first FPGA board performs a main arithmetic operation and periodically outputs a beating signal (S10). Then, the beating signal transmitted from the operational FPGA is monitored by the monitoring FPGA of the first FPGA board (S20). In operation S30, it is determined whether a failure has occurred in the operational FPGA of the first FPGA board. Specifically, for example, if the beep signal is not transmitted to the monitoring FPGA from the computation FPGA for a predetermined time, it can be determined that the computation FPGA has failed. Also, in the embodiment, the transmission of the beating signal between the first FPGA board and the second FPGA board is performed through the beating signal transmission bus independently provided in the redundant backplane.

As a result of the determination in step S30, if a failure occurs in the operation FPGA of the first FPGA board, the monitoring FPGA of the first FPGA board stops the operation FPGA and does not provide the beating signal to the second FPGA, 2 Monitoring of FPGA board The FPGA is informed of the start of the redundant transfer (S40).

The monitoring FPGA of the second FPGA board receiving the duplication transfer start command may be configured so that the first FPGA board and the second FPGA board are operated in a state where the operation FPGA of the second FPGA board is switched to perform the function and operation of the operation FPGA of the first FPGA board The redundant transfer of the FPGA board is performed (S50).

As described above, according to the FPGA-based redundancy control device and the redundancy switching method according to the embodiments of the present invention, even if one FPGA board among the redundant FPGA control devices fails, It is possible to maintain normal operation by the other FPGA board by performing redundancy switching. In addition, when applied to a nuclear power plant measurement control system, it can be replaced with analog and DSP (Digital Signal Processor) boards to perform main computation functions. By using redundant FPGAs, the utilization of control devices can be further improved.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the essential characteristics thereof. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas falling within the scope of the same shall be construed as falling within the scope of the present invention.

200 - Redundant FPGA platform architecture 210 - Redundant power supply modules
220 - Redundant FPGA control board 230 - Communication board
240 - Signal input / output board

Claims (16)

A signal input / output unit having a redundant structure for receiving and outputting a signal through a data bus provided in a redundant backplane;
A dual-structure beacon signal transfer bus independently provided with the data bus on the redundant backplane and periodically transmitting and receiving a beating signal between the first FPGA board and the second FPGA board;
A redundant first FPGA board and a second FPGA board; And
And a redundant switch signal processor for performing redundant switching in a state where any one of the first FPGA and the second FPGA is switched to perform another function and operation when the beep signal is not applied,
Wherein each of the first FPGA board and the second FPGA board includes:
A computational FPGA implemented as an FPGA device that performs one or more output functions to control the instrumentation control system of a nuclear power plant to generate output data, stores the generated output data in an internal memory, and periodically generates a beating signal; And
A monitor FPGA that monitors a pulse signal transmitted from the operation FPGA and is implemented as an FPGA device,
The monitoring FPGA includes:
If a pulse signal is not received from the operation FPGA for a predetermined period of time, it is determined that a failure has occurred in the operation FPGA, and a stop signal for forcibly stopping operation of the operation FPGA is provided to the operation FPGA. To perform redundant switching, and then,
When the pulse signal is transmitted from the computation FPGA within a predetermined time and it is determined that an error has occurred as a result of execution of a self diagnosis function, the delivered beatsignal is not provided to another FPGA board ,
An FPGA-based redundancy controller. delete The method according to claim 1,
The monitoring FPGA of the first FPGA board monitors a pulse signal transmitted from the operation FPGA of the first FPGA board and determines that the operation FPGA of the first FPGA board is faulty if the pulse signal is not transmitted for a predetermined time, Lt; RTI ID = 0.0 > FPGA < / RTI > board,
An FPGA-based redundancy controller. The method according to claim 1,
Characterized in that the bus module of the duplicated backplane comprises a redundant data bus each having a size of 32 bits and a bus for transmitting a dual pulse signal having a size of 8 bits each.
An FPGA-based redundancy controller. The method according to claim 1,
Wherein the heartbeat signal transmission method uses an SPI (Serial to Parallel Interface) method.
An FPGA-based redundancy controller. The method according to claim 1,
The signal input /
Further comprising a redundant power supply for supplying power to at least one of the operational FPGA, the monitoring FPGA, and the redundant switching signal processor.
An FPGA-based redundancy controller. The method according to claim 1,
The monitoring FPGA further includes a monitoring timer accommodated in the monitoring FPGA,
Wherein the monitoring timer generates a stop signal of the operational FPGA if the beep signal is not input for a predetermined time.
An FPGA-based redundancy controller. 8. The method of claim 7,
Wherein the monitoring FPGA of the first FPGA board does not provide the beating signal to the second FPGA board when a stop signal of the operational FPGA of the first FPGA board is generated.
An FPGA-based redundancy controller. delete The method according to claim 1,
And an internal memory for storing a signal of the signal input / output unit,
Wherein the operation FPGA generates the output data using a signal stored in the internal memory.
An FPGA-based redundancy controller. The method according to claim 1,
The signal is an analog signal or a digital signal,
Wherein the signal input / output unit receives the analog signal or the digital signal from a measurement control system of a nuclear power plant.
An FPGA-based redundancy controller. The method according to claim 1,
The signal is an analog signal or a digital signal,
And the signal input / output unit outputs the analog or digital signal to the measurement control system of the nuclear power plant.
An FPGA-based redundancy controller. The method according to claim 1,
And a display unit for displaying a normal operation state or a failure state of the operational FPGA based on the beating signal.
An FPGA-based redundancy controller. A method for redundant switching of a redundant FPGA board that receives or outputs a signal through a data bus of a redundant backplane,
Performing a main operation function by the operation FPGA of the first FPGA board and periodically outputting a pulse signal;
Transferring the beating signal between the first FPGA board and the second FPGA board through a dual-structured beacon signal transmission bus provided independently of the data bus of the redundant backplane;
Generating at least one output data in accordance with execution of a main operation function by the operational FPGA of the first FPGA board and storing the generated output data in an internal memory;
Monitoring a beating signal transmitted from a computing FPGA of the first FPGA board by a monitoring FPGA of the first FPGA board and determining whether a failure of the computing FPGA of the first FPGA board occurs based on the monitoring result;
The step of not providing the delivered beating signal to the second FPGA board when it is determined that a beating signal is delivered from the computing FPGA of the first FPGA board within a predetermined time and that an error has occurred as a result of performing a self diagnosis function ;
If the monitoring FPGA of the first FPGA board does not receive a pulse signal for a predetermined time from the operation FPGA of the first FPGA board, it is determined that the operation FPGA of the first FPGA board has failed, Forcibly stopping the operation of the controller;
When a failure occurs in the operational FPGA of the first FPGA board, the monitoring FPGA of the first FPGA board informs the monitoring FPGA of the second FPGA board of the start of redundant switching;
Performing a redundancy switching of the first FPGA board and the second FPGA board in a state where the operational FPGA of the second FPGA board is switched to perform the function and operation of the operational FPGA of the first FPGA board ≪ / RTI >
An FPGA-based redundancy switching method. delete delete

Images