RU2745946C1 - Redundant control system based on programmable controllers - Google Patents

Abstract

FIELD: industrial automation.SUBSTANCE: invention relates to control systems for industrial automation based on programmable controllers. The technical result of the proposed technical solution is achieved by the fact that processor modules and input-output modules are used as redundant components, redundant communication lines between them are made in the form of two independent CAN data transmission buses, and the outputs of redundant power supplies are connected to the power supply circuits of the redundant components through diode isolation.EFFECT: invention ensures fault tolerance of the control system for industrial automation.1 cl, 3 dwg

Description

The invention relates to control systems for industrial automation based on programmable controllers and can be used for automated control of complex technological processes in various fields, where failures and failures in the control system lead to accidents and significant material losses. These include, for example, technological processes for the extraction, transportation and processing of raw materials in the oil and gas industry, power distribution systems, continuous technological processes, etc.

In such areas, to increase the reliability and fault tolerance of control systems, redundancy is used, which is practically the only and widely used method of dramatically increasing the reliability of automation systems. It allows you to create responsible systems in which even a short downtime leads to large financial losses.

The known control system of the gas pumping unit according to the utility model No. RU 29593 dated 12/30/2002, This system consists of a control panel, microprocessor controllers, input-output modules, blocks of executive relays. It also contains redundant serial communications, redundant I / O modules, microprocessor controllers, and analog-to-digital converters, with each of the control system components connected to two independent power supplies.

The disadvantages of the known control system include complexity and lack of reliability.

Also known is a redundant control system for industrial automation based on programmable controllers S7-400H from SIEMENS (catalog "Components for integrated automation of products" from SIEMENS, Siemens ST70, 2010, Web site www.siemens-pro.ru/components/s7-400 .htm), taken as a prototype.

The known control system contains a top-level device, redundant components, communication lines between them and power supplies, while the top-level device is connected to the redundant components.

The disadvantages of the known system include considerable size, cost and a certain "inflexibility" of the entire system as a whole, as well as insufficiently high reliability of the system.

In addition, in the known system, there is an additional information load on programmable controllers due to the absence of "hot" redundancy at the level of interface modules and input / output modules, an additional delay in switching to the reserve in case of failures of the Ethernet bus network equipment.

These disadvantages are a consequence of the redundancy methodology adopted in the known system at the controller level, i.e. quite cumbersome in the physical and systemic sense of the configuration.

The positive effect of using the proposed system lies in reducing the size and cost, as well as in the flexibility of the possible construction of the system, depending on the specification of the problem being solved and in increasing the reliability (fault tolerance).

The achieved positive effect is due to the fact that, in contrast to the known system, in the proposed control system, redundancy of components is carried out at the level of functional modules (not controllers): processor modules and input-output modules. This implementation of the control system allows you to optimize its composition and, accordingly, the cost, depending on specific conditions.

The use of a storage battery as one of the backup power sources allows increasing the reliability (fault tolerance) of the proposed control system.

The indicated positive effects from the use of the proposed redundant control system for industrial automation based on programmable controllers are achieved by the fact that processor modules and input-output modules are used as redundant components, two independent CAN data transmission buses are used as redundant communication lines between them, and A rechargeable battery is used as one of the backup power supplies, while the outputs of the power supplies are connected to the power circuits of the redundant components through diode decoupling.

The technical result from the use of the proposed invention is the fault tolerance of the control system for industrial automation. This result is achieved using a redundant control system based on programmable controllers, containing a top-level device, redundant components, communication lines between them and power supplies, while the top-level device is connected to redundant components, characterized in that processor modules are used as redundant components and input-output modules, as redundant communication lines between them, two independent CAN data buses are used, and a battery is used as one of the backup power sources, while the outputs of the power supplies are connected to the power supply circuits of the redundant components through diode decoupling.

The proposed technical solution is illustrated by graphic materials, where in Fig. 1 shows a block diagram of a redundant control system for industrial automation based on programmable controllers, FIG. 2 shows a diagram of the implementation of a redundant power supply circuit using diode decoupling, FIG. 3 is a photo of one of the variants of the proposed system implementation.

A redundant control system for industrial automation based on programmable controllers contains a top-level device 1, which is used as an automated workstation for the operator of the control system.

The controller part of the control system is located in the crate 2 and consists of the main processor module 3, the backup processor module 4, I / O modules 5 and two independent CAN buses 6, 7 for data transmission connecting the specified components of the control system.

The first Ethernet port 1 of each of processor modules 3 and 4 is used to connect and communicate with the upper-level device 1. The second Ethernet port 2 of processor modules 3 and 4 is used to synchronize signals and states when the processor module is redundant. Data exchange of each processor module with I / O modules is carried out simultaneously via two CAN buses 6 and 7.

In terms of circuit implementation and software, processor modules 3 and 4 are identical.

If necessary, the proposed redundant control system for industrial automation can be expanded by connecting an additional crate 9 with input-output modules 8, docked to the main crate and providing communication with it via CAN buses 6 and 7.

All components and modules of the control system are powered from a group of power sources, which can be used, for example, the following (see Fig. 2):

- the main power source 10, made according to the scheme of the voltage converter of the electrical network 220 V, 50 Hz to voltage 24 V DC;

- the first backup power supply 11, made in the same way;

- the second backup power source 12, made in the form of a storage battery with a voltage of 24 V.

The power supplies 10, 11, 12 are connected to the components of the control system through a diode decoupling of semiconductor diodes 13, 14 and 15, which provide protection of the power supplies against cross-circuit.

The proposed redundant control system for industrial automation based on programmable controllers operates as follows.

At power-up, the processor module determines its role (primary or backup) based on the position in the rack in which it is installed. The main processor module is a processor module installed in the first slot of the cradle, the backup processor module is a processor module installed in the second slot of the cradle.

Based on its role (primary or backup), the processor module chooses the backup operation algorithm.

The algorithm for determining the activity of the main processor module 3 is as follows:

- the availability of any I / O module 5 or 8 is determined for each of the CAN interfaces (CAN buses 6 and 7). If at least one I / O module is available for each of the interfaces, then this CAN interface is considered operational;

- if both CAN interfaces are faulty, then the main processor module 3 transfers itself to a passive state, otherwise it is in an active state;

- sends service heartbeat signal packets via both CAN interfaces to signal the backup processor module 4 about its health and activity. If it is necessary to switch to the backup processor module 4, the sending of service heartbeat packets must be stopped.

The algorithm for determining the activity of the backup processor module 4 is as follows:

- the availability of any I / O module for each of the CAN interfaces is determined. If at least one I / O module is available for each of the interfaces, then this CAN interface is considered operational;

- if both CAN interfaces are considered serviceable, then the processor module 4 checks for the presence of service heartbeat packets from the main processor module;

- if service heartbeat packets are not received via any of the CAN interfaces, indicating the health of the main processor module 3, then the backup processor module 4 switches itself into an active state, otherwise into a passive one.

Thus, each of the processor modules in the process of functioning performs the following operations:

- when the power is turned on, it determines its role in the redundant control system (main or standby);

- constantly determines its status (active or passive);

- in the active state, it reads information from the input I / O modules, processes the received information in accordance with the laid down algorithm, issues control signals to the network and to the passive processor module, writes the signal values to the output I / O modules, generates service heartbeat packets;

- in the passive state, it reads information from the input I / O modules, processes the received information in accordance with the laid down algorithm, receives service signals from the active processor module, but does not issue control signals to the network and does not write the signal values to the output I / O modules ...

That is, both processor modules (main 3 and backup 4) operate with the same user program, with the same data blocks, with the same contents of the process display area, with the same internal data (bits memory, timers, counters, etc.).

Bumpless switching of processor modules is ensured when they work synchronously. Synchronization functions are performed automatically by the operating system and do not require user programming.

The algorithm of the proposed control system also includes a set of self-diagnostic functions. A report is generated about any detected problem and sent to the upper level device 1. Diagnostics are performed for CAN data bus states, central processor states, microprocessor states and specialized microcircuits.

When the controller is rebooted, the self-diagnostic functions are performed in full. During program execution, to reduce the load on the central processor, only a part of the self-diagnostic functions are performed in each cycle. The full range of self-diagnostic functions is performed in several cycles of program execution.

The proposed control system also has redundant communication lines (two independent CAN data buses) and I / O modules 5 and 8.

The serviceability of communication lines is monitored by known methods, for example, by the presence of signals from input-output modules.

The following values and events can be used to monitor the health of I / O modules:

- root-mean-square value of noise voltage or current;

- zero bias voltage;

- temperature inside the module case;

- error (estimated using the built-in reference voltage source);

- checksum error;

- an error in the response to the command, etc.

In the proposed control system, power supplies 10, 11 and 12 are also redundant (see Fig. 2). Moreover, the connection of the control system components to power sources is carried out through diode decoupling on semiconductor diodes 13, 14 and 15. Diode decoupling prevents cross-circuit of power supplies 10, 11 and 12, and if one of them fails, the power supply of the control system components is automatically redistributed between serviceable sources. In the event of a simultaneous malfunction of both sources 10 and 11 (for example, in the event of a large-scale power failure), the battery 12 supplies power within the limits of its electrical capacity.

Thus, the proposed redundant control system for industrial automation based on programmable controllers operates on the principle of "hot" redundancy, when redundant components are connected, loaded, receive and process current information along with the main components and are in constant readiness to switch to active mode. With such a configuration of the control system, the time for switching from any faulty module to a working backup is from a few milliseconds to fractions of a second, which allows us to speak of a bumpless switch to backup components.

Information about the functioning and status of processor modules 3 and 4, as well as I / O modules 5 and 8, through the first Ethernet ports enters the upper-level device 1. In the event of a malfunction, thanks to the design described above and the described operation algorithm, the redundant components instead of faulty ones with immediate notification of the upper-level device 1. The operator of a workstation, having received such a notification, must immediately take the necessary measures to restore the control system reliability margin lost as a result of a fault (physical replacement of a faulty component with a good one).

The proposed redundant control system for industrial automation based on programmable controllers is small and easy to use (Fig. 3), assembled on a domestic element base and can be used to control complex technological processes in various industries.

Claims (1)

Redundant control system for industrial automation based on programmable controllers, containing a top-level device, redundant components, communication lines between them and redundant power supplies, while the top-level device is connected to redundant components, characterized in that processor modules are used as redundant components and I / O modules, redundant communication lines between them are made in the form of two independent CAN data transmission buses, and the outputs of redundant power supplies are connected to the power supply circuits of the redundant components through diode decoupling.

Images