JP2003345401A - Highly reliable process control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize multiplexing of only a function unit whose reliability needs to be heightened and eliminating an unnecessary unit to facilitate maintenance and improve reliability in the event of a failure. <P>SOLUTION: An autonomously controlling CPU and an interface for connection to a network are laid individually to each function unit of a controlling and processing unit to process data and create a control signal and a signal I/O unit for the control signal and a data signal entered from a device to be controlled. Each of the function units are connected through the network and a plurality of the function units grouped for the same purpose are connected by a link for a configuration control for high-speed switching. This allows selection of a degree of redundant configuration corresponding to the importance of the function unit of which the reliability needs to be heightened. <P>COPYRIGHT: (C)2004,JPO

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a highly reliable type having a redundant configuration by multiplexing the same configuration in order to prevent the operation from being stopped when a failure or other trouble occurs when controlling various processes. The present invention relates to a process control device.

[0002]

2. Description of the Related Art Conventionally, as shown in FIG. 11, a process control device having a redundant configuration for such a purpose includes a plurality of control devices 101 having the same configuration and an upper-level monitoring device 102 for monitoring these control devices 101. Are connected by a LAN 103 or the like (Japanese Patent Laid-Open No. 2000-56817).
The control device 101 includes a CPU, a RAM, and a ROM.
In addition, the interface unit 104 for input / output of control signals and data has been constituted by one independent computer individually connected by an internal high-speed bus. Then, when a failure occurs in any of the control devices 101, the upper-level monitoring device 102 detects the failure, and switches to a normal control device 101 in which no failure has occurred to continue the operation. In such a configuration, a plurality of control devices 101 always receive the same data and internally perform the same processing, and a dual system in which only one of the control devices 101 outputs control data or the like, There is a duplex system in which data is transferred from the operating control device 101 to the standby control device 101 when a failure occurs to switch the operation.

[0003]

In the above-described conventional example, a plurality of independent control devices 101 having the same configuration and having all functions including portions that do not need to improve reliability are required. There is a problem that only a plurality of components are required. In addition, if the number of components is plural, the frequency of occurrence of failures as a whole of the apparatus is multiplied and the maintenance becomes more necessary.
In addition, since each unit in the control device 101 is individually connected by a high-speed bus, there is a problem that parts cannot be replaced or repaired unless the power supply of the entire control device 101 is stopped. Furthermore, in the case where only one control device 101 can be operated during parts replacement or repair work, if a failure occurs, the process control must be stopped, and the reliability of the entire control device is reduced. Had been lowered. For example, when the control device 101 is completely duplicated, the input / output interface unit 104 of one control device 101 fails and the other control device 10
Even in the case of a double failure in which another unit other than one interface unit has failed, there is a problem that process control cannot be performed. In order to prevent this, the number of control devices 101 is increased,
It is necessary to double the size, which further deteriorates the maintainability and the like.

[0004]

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and has a control processing unit for processing data to generate a control signal, and a control processing unit for generating a control signal. Control unit having a control signal and a signal input / output unit for a data signal input from a controlled device, a CPU for autonomously controlling the function unit and an interface for connecting to a network Are provided separately, and each functional unit is interconnected by a network, and
A high-reliability process control apparatus characterized in that a plurality of functional units for the same purpose, which are grouped among these functional units, are interconnected by a configuration control link for high-speed switching. All the operation units and the standby units of the functional units forming the group perform the same processing independently by receiving the input of the processing data, and the standby unit is configured to stop the output after the processing. ing.

[0005]

DESCRIPTION OF THE PREFERRED EMBODIMENTS In the present invention, functional units for process control are roughly divided into a control processing unit 1 and a signal input / output unit. Further, this signal input / output unit is a DI / DO unit ( An example in which an AD / DA unit is included) and a communication unit 8 will be described. Each of the functional units is provided with a CPU for autonomous control and an interface for connection to a network, and the functional units are interconnected by a network. FIG. 1 shows a first embodiment of the present invention, and a case where the DI / DO unit 2 is multiplexed in order to improve the reliability will be described as an example. 1 is
It is a control processing unit, and includes a CPU 5, a RAM (not shown), a ROM (not shown), and the like, and outputs control signals and control data to the controlled device for process control of the controlled device. It performs data input commands and data processing from the control device. This control processing unit 1
Is connected to the LA via an interface (not shown) for connection.
N and the like.

Reference numerals 2 ₁ , 2 ₂ , and 2 ₃ denote DI / DO (digital input / digital output) units for inputting and outputting data from the controlled device and control signals to the controlled device as digital signals. In the embodiment of FIG. 1, three DI / DO units 2 ₁ , 2 ₂ , and 2 ₃ for the same purpose are multiplexed to form one unit group, and each DI
The DO units 2 ₁ , 2 ₂ , and 2 ₃ are mutually connected by a configuration control link 7 connected by a serial or parallel signal line for high-speed processing. These multiplexed 3
The DI / DO units 2 ₁ , 2 ₂ , 2 ₃ input control signals of these DI / DO units 2 ₁ , 2 ₂ , 2 ₃ as shown in FIG. and OR output, all DI · DO unit 2 ₁ data from the controlled device, ₂ 2, 2 ₃ redundancy for IO terminal 4 for inputting to
It is connected to the. In addition, DI / DO unit 2 ₁ ,
2 ₂ and 2 ₃ are connected to the network 3 via a connection interface (not shown). Each DI ・ D
The O units 2 ₁ , 2 ₂ , and 2 ₃ have a CPU 5, a RAM (not shown), an RO,
M (not shown) and the like are provided.

Next, the operation of the first embodiment will be described. First, in an initial state in which all of the process control device is operating normally, from a group of DI · DO unit, for example, 2 ₁ node number youth numbered DI · DO unit is used. Therefore, the redundant configuration IO
Terminal 4, DI · DO unit 2 _1, data from the control device via the network 3 a control processing unit 1
And the control signal is sent to the controlled device along the reverse route. During this time, DI · DO unit 2 _2, 2 _3, which via a redundant configuration for IO terminal 4 has received data from the controlled device (input), the control processing unit 1,
The data processing of the DI / DO units 2 ₂ and 2 ₃ is not performed, and the control signals from the control processing unit 1 are all received by the DI / DO units 2 ₁ , 2 ₂ and 2 ₃ . In the output to the redundant configuration IO terminal 4,
The DI / DO unit 2 in operation from the condition of the part a in FIG.
Only _one signal is output. Further, each unit of the control processing unit 1, DI · DO unit 2 _{1, 2} 2, 2 _3, performs the transmission output of the processing information at a predetermined period of 1msec~5msec by the token system for cyclic transmission right at a constant period, As shown in FIG. 6, memory information is shared.

[0008] DI · DO unit 2 _{1, 2} 2, 2 ₃ of the abnormality detection is performed as shown in FIGS. First,
As shown in part b of FIG. 2, the abnormality detection uses an abnormality detection by a hardware watchdog mechanism and an abnormality detection by an abnormality in software output, and generates an abnormality signal when an abnormality is detected by either of them. I do. For example, when the abnormal signal is generated in DI · DO unit 2 _1,
Via the configuration control link 7 and outputs an abnormality of the self-unit to the other DI · DO unit 2 _2, 2 ₃ in the group signals of the redundant control 1b of FIG. 2, also resets the network interface disconnecting the own unit 2 ₁ from the network. Furthermore, the control of the self unit 2 ₁ locked by a portion of FIG. 2, the control lock setting If on, blocking the DO circuit of its own unit 2 _1. Lock control of the self unit 2 ₁ is effective even manually by a soft output control lock can also be disabled.

[0009] Other DI · DO unit in the group 2 _2, 2 _3, as well as detecting the configuration via the control link 7 of the unit 2 ₁ anomaly, also detected by the abnormality of the transmission signal by the token scheme but unit 2 ₁ anomalies in a group unit, it via the configuration control link 7 is detected at a high speed. DI / DO unit 2 ₂ ,
When 2 ₃ detects another DI · DO unit 2 ₁ abnormality in a group, as shown in FIG. 3 (a), to determine the operation unit for example, DI · DO unit 2 _2, the reconstruction process associated performed, and the output state own unit 2 ₂ dO, which is a driving unit. The operating unit is determined from the units that can operate normally except for the unit that outputs the abnormal signal. The order of determination is as shown in FIG. And The order of determination is not limited to this method, and may be a unit having a node number one higher or lower than the unit stopped due to the abnormality. The rules for determining these rankings are:
It can be set in advance so that either one is selected according to the purpose.

[0010] IO terminal 4 for redundancy, as shown in FIG. 4, and outputs DI · DO unit 2 _{1, 2} 2, 2 ₃ of the OR result of the output to the controlled device. In addition, the redundant configuration I
O terminal 4, as shown in FIG. 5, and inputs the input from the controlled device to all DI · DO unit 2 _{1, 2} 2, 2 _3.

[0011] In the configuration functional units as shown in FIG. 6, data transmitted by the token scheme, the same address of the memory of each unit 1 _1, 1 _2, 2, receiving data identical units Remember the information,
Receiving information of the unit 1 ₁ waiting reads as not referenced by the control program are prohibited, the failure of the operation unit 1 _2, in its standby to have the unit 1 ₂ is operated device It is reconfigured and the read prohibition is released when the operation starts, and it can be used.

In the embodiment shown in FIG. 1, the number of the control processing units 1 is one, and the DI · D
The O unit 2 was composed of three units. The process control device having the configuration in which the IO terminal for inputting / outputting the data signal from the controlled device is replaced by the redundant configuration IO terminal 4 because the DI / DO2 unit is multiplexed has been described. The present invention is not limited to this embodiment.
0 can be applied, and still another configuration can be applied.

FIG. 7 shows a multiplexed control processing unit 1 (2
And the DI / DO unit 2 is a single unit. Since the control processing units 1 are multiplexed, they are interconnected by a configuration control link for switching between the control processing units at high speed. DI / DO unit 2 is 1
Since it is platform, IO unit is an example configured with a normal IO terminals 4 ₁ not for redundancy.

FIG. 8 shows one control processing unit 1,
In this embodiment, the communication units 8 are multiplexed (three units), and the multiplexed communication units are interconnected by a configuration control link for switching between the multiplexed communication units at high speed. Note that the communication unit 8 is connected to the controlled device via the network 10 because of the communication unit 8.

FIG. 9 shows a configuration in which one control processing unit is added to the configuration of FIG. 1 and the control processing units are multiplexed (two units).
In this embodiment, the multiplexed control processing units are interconnected by a configuration control link for switching at high speed. The operation is substantially the same as in FIG.

FIG. 10 shows the control processing unit 1, DI · D
O unit 2, the IO terminal 4 ₁ one by one as one set, they show an example in which multiplex constituted by two sets, each set of control processing unit 1 ₁ and the control processing unit 1 ₂ between the configuration control , But the configuration control link 7 between each pair of DI / DO units 2 is not provided. In this embodiment, an upper monitoring device 9 is connected to the network 3 to monitor each unit.

In addition to the above embodiment, any combination of two or more of the multiplexing of the control processing unit 1, the multiplexing of the DI / DO units, and the multiplexing of the communication units can be adopted.
Further, a set of any two or more combinations of the control processing unit 1, the DI / DO unit, and the communication unit may be multiplexed.

[0018]

Since the present invention has the above-described configuration, in the process control processing in which reliability and safety are given the highest priority, the degree of the redundant configuration is required for each functional unit for which the reliability needs to be improved. It can be selected according to the degree of importance, such as duplexing, tripleting, etc., unnecessary redundancy can be eliminated, and the number of components of the device can be reduced accordingly, and maintenance can be reduced. Has an effect. In addition, since all functional units are connected via a network, even if a failure occurs, only the failed unit needs to be stopped, and parts can be replaced without stopping any other units on the network. Even if a plurality of faults occur, the process control can be continued unless all the units in the same group fail.

Further, since units having the same function are grouped and connected within the group by the configuration control link, the units can be quickly switched when a failure occurs, and interruption of the control process can be minimized. . Further, there is an effect that the functional units can be added or deleted as needed even after the control device is constructed.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a first embodiment of a highly reliable process control device of the present invention.

FIG. 2 is a logic diagram showing an operation when a failure occurs in the DI / DO unit of FIG. 1;

3A is a flowchart illustrating switching control of a functional unit, and FIG. 3B is a logic diagram illustrating a condition for switching to a self-unit.

FIG. 4 is a logic diagram showing an output mechanism of the redundant configuration IO terminal shown in FIG. 1;

FIG. 5 is a logic diagram showing an input mechanism of the redundant configuration IO terminal shown in FIG. 1;

FIG. 6 is a block diagram illustrating a method of using fixed-cycle reception information by a token method in each functional unit.

FIG. 7 shows a second example of the highly reliable process control device according to the present invention.
It is a block diagram showing an example.

FIG. 8 shows a third example of the highly reliable process control apparatus according to the present invention.
It is a block diagram showing an example.

FIG. 9 shows a fourth example of the highly reliable process control apparatus according to the present invention.
It is a block diagram showing an example.

FIG. 10 is a block diagram showing a fifth embodiment of the highly reliable process control device according to the present invention.

FIG. 11 is a block diagram showing a conventional example.

[Explanation of symbols]

1 ... control processing _{unit, 2,2 1, 2 2, 2} 3 ... DI ·
DO unit, 3 network, 4 IO terminal for redundant configuration, 4 ₁ IO terminal, 5 CP
U, 7: Configuration control link, 8: Communication unit, 9
... High-order monitoring device, 10 ... Network on the controlled device side.

Claims (7)

[Claims] A control processing unit for processing data to generate a control signal; and a signal input / output unit for a control signal generated by the control processing unit and a data signal input from a controlled device. In the process control device having the above, each of the functional units is provided with a CPU for autonomous control and an interface for connecting to a network, and the functional units are interconnected by a network, and Of the functional units that are grouped and have the same purpose,
A highly reliable process control device which is interconnected by a configuration control link for high-speed switching. 2. A control processing unit for processing data to generate a control signal, a DI / DO unit for a control signal generated by the control processing unit and a data signal input from a controlled device via an IO terminal, and / Or AD / D
In a process control device having each functional unit with an A unit, a CPU for autonomously controlling each functional unit and an interface for connecting to a network are separately provided, and each functional unit is interconnected by a network. And the DI / DO unit and / or the AD / DA unit are multiplexed by a plurality of units for the same purpose, and between the units in the multiplexed group,
A high-reliability process control device, wherein the IO terminals are connected to each other by a configuration control link for high-speed switching, and the IO terminal is a redundant configuration terminal. 3. A control processing unit for processing data to generate a control signal, and a functional unit including a control signal generated by the control processing unit and a signal input / output unit for a data signal input from a controlled device. In the process control device having the above, each of the functional units is provided with a CPU for autonomous control and an interface for connecting to a network, and the functional units are interconnected by a network, and A high reliability, wherein the control processing units among the functional units are multiplexed by a plurality of units for the same purpose, and the multiplexed control processing units are interconnected by a configuration control link for high-speed switching. Type process control device. 4. A process control comprising a control processing unit for processing data to generate a control signal, and a communication unit for exchanging data with the control signal generated by the control processing unit and a controlled device. In the device,
A CPU for autonomously controlling each of the functional units and an interface for connecting to a network are separately provided, the functional units are interconnected by a network, and the communication units are multiplexed by a plurality of units. And
The units in the multiplexed group are interconnected by a configuration control link for high-speed switching, and input / output of a data signal from the controlled device to the communication unit is performed via a network. A highly reliable process control device characterized by the following. 5. A control processing unit for processing data to generate a control signal, a DI / DO unit for a control signal generated by the control processing unit and a data signal input from a controlled device via an IO terminal, and / Or AD / D
In a process control device having each functional unit with an A unit, a CPU for autonomously controlling each functional unit and an interface for connecting to a network are separately provided, and each functional unit is interconnected by a network. And the control processing units are multiplexed by a plurality of units, and the multiplexed control processing units are mutually connected by a configuration control link for high-speed switching,
Further, the DI / DO unit and / or the AD / DA unit are multiplexed by a plurality of units for the same purpose, and the units in the multiplexed group are interconnected by a configuration control link for switching at high speed. A highly reliable process control device wherein the IO terminal is a terminal for a redundant configuration. 6. A control processing unit for processing data to generate a control signal, a DI / DO unit for a control signal generated by the control processing unit and a data signal input from a controlled device via an IO terminal, and / Or AD / D
In a process control device having each functional unit with an A unit, a CPU for autonomously controlling each functional unit and an interface for connecting to a network are separately provided, and the control processing unit and the DI.
A combination of a DO unit and / or an AD / DA unit connected by a network constitutes a set, and the set is multiplexed in a plurality of sets with the set as a unit. A highly reliable process control device, wherein a monitoring device is connected, and the multiplexed sets of control processing units are mutually connected by a configuration control link for high-speed switching. 7. All the operation units and standby units of the functional units forming the group independently perform the same processing by receiving processing data,
7. The highly reliable process control device according to claim 1, wherein the standby unit stops output after processing.