JPS6321929B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a redundant system composed of a plurality of microcomputers, and can be applied to a burner automatic control device composed of a plurality of loops, for example, to obtain great effects.

A system consisting of a plurality of control systems, for example, a burner automatic control device 1 of a thermal power plant as shown in FIG.
(hereinafter abbreviated as ABS), each burner constitutes one system. Typically, there are 16 to 32 sets of burners, so the ABS will consist of a system with 16 to 32 loops. FIG. 1 shows an example of four loops. This burner 1 loop is composed of a fuel valve V, a burner G, an air register damper D, a solenoid valve for driving these, a limit switch for monitoring the state, and the like. These status signals are taken into the logic cabinet and subjected to logic operations. The calculation results are output to each solenoid valve as a control signal. As for the hardware of this arithmetic control circuit, one microcomputer is distributed for each burner loop. In other words, ABS is composed of a large number of these microcomputers.

By the way, a failure in one part of a microcomputer will affect the whole, so it is difficult to use a microcomputer like this ABS.
When the object to be controlled is a combustion device, safety is particularly required, so high reliability is required. As a measure to improve this reliability, there is a redundant system configuration, and examples of this conventional technology include a dual system configuration shown in Figure 2, and a redundant system configuration shown in Figure 3.
There is a one-to-one backup system configuration.

FIG. 2 will be explained. Each loop consists of a regular microcomputer M, a standby microcomputer B, a switching circuit T, and a PI/O that interfaces input/output with processes.
The system is a multiple system, and the entire system has a distributed system configuration of a dual system.

In this method, each loop unit is a double system, so
Although it is highly reliable, the microcomputer is
It has the drawbacks of double the size, larger scale, and higher cost.

Figure 3 shows N
Add microcomputer B to the microcomputers M ₁ to M _N for backup,
This is an _{N -} to-1 backup system configuration that is provided for backup when any of the microcomputers M1 to MN fails.

The backup method of this system will be explained by taking as an example a case where the regular microcomputer _M1 has failed. Microcomputer _M1 is a switching circuit
T ₁ interfaces with the process via the input/output circuit PI/O ₁ . At the same time, microcomputer _M1 receives input/output status signals, calculation output signals,
And, the failure diagnosis information of the microcomputer is output to the standby microcomputer B.
Since the programs of the regular microcomputers M ₁ to M _N of each control loop are different, the standby microcomputer stores all these programs in its own memory circuit B-2, and each regular microcomputer M The input/output status signals and calculation output signals transferred from ₁ to M _N are taken into the buffer memory circuit B-3, and based on these information,
Calculations are performed one by one according to the programs M ₁ to M _N stored in the memory circuit B-2. B-1 is a control circuit for a standby microcomputer.

Now, if microcomputer _M1 breaks down,
The microcomputer M ₁ switches the switching circuit T ₁ to the standby microcomputer B side, and at the same time, the standby microcomputer B switches the selection circuit S to the switching circuit T ₁ side to continue control.
This method has advantages in terms of scale and cost because it only requires the addition of one standby microcomputer, but the standby microcomputer stores all programs of microcomputers _M1 to _MN , calculation results, etc. information must be input and calculated, so firstly, it requires N times the processing power and processing speed of the regular-use microcomputers M ₁ to M _N , and secondly, it needs to interface with the regular-use system. This has the disadvantage that the transmission path and the transmission path of the selection circuit become large-scale.

The object of the invention is to eliminate the drawbacks of the prior art and to
The purpose of the present invention is to provide a redundant microcomputer system in which the system is configured with two microcomputers and one spare microcomputer with the same hardware, and if one of them fails, the spare microcomputer performs backup control. .

In the present invention, N+1 microcomputers are provided for N loops of the control system, one of which is normally used as a standby machine, and when one of them fails, it is used as a backup machine. These N
+1 microcomputer is connected via a data freeway, interfaces data with each input/output circuit, and controls processes.

An embodiment of the present invention will be described using FIG. 4. Corresponding to each control loop, a transmission path (data freeway) is established between the regular microcomputers M ₁ to M _N and a spare microcomputer SC with the same hardware as these regular microcomputers.
11 to each input/output circuit PI/O ₁ to PI/O _N
combine. The correspondence between this microcomputer and the input/output circuits PI/O ₁ to PI/O _N is the transmission line control circuit.
BC and input/output circuits PI/O ₁ to PI/O _N as transmission line 11
Input/output control circuit for interfacing with
This is done by S ₁ to S _N. Incidentally, since the programs of the microcomputers _M1 to _MN generally differ depending on the corresponding control loops, a data file memory 10 is provided and each program is stored in this memory. Furthermore, data such as each input/output status signal that changes every moment and the calculation result signal of each microcomputer are always inputted to this memory via the transmission line 11 and the transmission line control circuit BC. The control circuit BC is
directly, each microcomputer M ₁ to _{M N} , and
Monitors SC abnormalities. Here, the transmission line control circuit BC may have a program for this abnormality monitoring, but for simplicity,
It is preferable that when each microcomputer detects its own abnormality using its own diagnostic program, it notifies the BC. For example, if the microcomputer _M1 fails, the transmission control circuit BC will
While transferring the _M1 program and _M1 data to the spare microcomputer SC, the spare microcomputer SC and the input/output control circuit _S1 are connected to the transmission line 11.
Connect via. As a result, the spare microcomputer is connected to the input/output circuit PI/O ₁ ,
It will perform backup control of microcomputer _M1 .

The microcomputers M ₁ to M _N , SC and each input/output control circuit S ₁ to _{S N} are connected via the transmission line 11 mentioned above.
The linkage with is controlled by signals as shown in FIG. That is, this signal consists of a command part, an address, and each data.

Next, details of each of the above-mentioned microcomputers, transmission control circuit, and input/output control circuit BC will be explained using FIG. 6. This figure will be explained using _M1 among _the commonly used microcomputers M1 to _MN as an example.

The microcomputer M ₁ , SC includes a memory circuit 21 for storing programs, an arithmetic circuit 22 , and a line control circuit 2 for exchanging data with a transmission path 31 .
3. It is composed of a lock circuit 25 that locks information exchange with the transmission line 31, and a control circuit 24 that performs fault detection and other overall control. Transmission line control circuit
BC is the control circuit 24 of each microcomputer
A control circuit 51 that monitors and controls the transmission line 31 and a line control circuit 52 that performs linkage control with the transmission line 31.

If the microcomputer _M1 breaks down, the linkage between the line control circuit 23 and the transmission line 31 is locked by the lock circuit 25, and at the same time, the control circuit 2
Control circuit 5 of control circuit BC transmits the fault signal from 4
Send to 1. When the control circuit 51 receives this failure signal, it selects the M ₁ program and M ₁ data in the data file memory 40 via the line control circuit 52 and transfers them to the transmission line 31 in accordance with the command shown in FIG. At the same time, a control signal for backing up _M1 is sent to the control circuit 24 of the standby microcomputer SC, the lock circuit 25 is unlocked, and the _M1 program and _M1 data transferred to the transmission line 31 are transferred to the line control circuit 23. The _M1 program is stored in the memory circuit 21 and transferred.
Perform initial calculation with M ₁ data. The result of this calculation is
connected to the input/output control circuit _S1 via the line control circuit 23, the lock circuit 25, and the transmission line 31;
Interfaced with input/output circuits. As a result of the above, the standby microcomputer SC performs backup control of the microcomputer _M1 .

As described above, according to the present invention, the standby microcomputer does not require N times the processing power and processing speed of the regular microcomputer, unlike the standby microcomputer shown in FIG. The same processing power and processing speed is sufficient. In other words, since the same hardware as the regular microcomputer can be used, any N of the N+1 microcomputers can be used for control, and the remaining one can be used as a standby machine.
A highly reliable and highly flexible system configuration can be achieved.

In the present invention, by configuring the system with a plurality of spare microcomputers, for example two, it is possible to prevent the system from going down even if two microcomputers fail at the same time.

Furthermore, as shown in FIG. 7, a transmission line 1 connects the microcomputers _M1 to _MN , SC, the transmission line control circuit BC, and the input/output control circuits _S1 to _SN .
1, a control transmission line 11A that directly controls the input/output control circuit PI/O _1N , and a data file memory 10.
It may also be configured to have a separate data transmission line 11B for transferring the input/output status of the microcomputer, the calculation results of the microcomputer, and the program and data of the microcomputer from the data file memory 10 when any microcomputer fails. . In this way, the data for the data file memory and the control signal are separated, so that the information processing capacity of the transmission path is reduced.

[Brief explanation of the drawing]

FIG. 1 shows a system overview of an automatic burner control device for a thermal power plant. FIG. 2 shows a system in which microcomputers for each control loop are duplicated. FIG. 3 shows a system consisting of a plurality of microcomputers and one standby microcomputer. FIG. 4 shows a system in which a plurality of microcomputers and one standby microcomputer are connected to input/output circuits by a transmission control circuit and a transmission path according to an embodiment of the present invention. FIG. 5 shows the structure of the transmission path control command word. FIG. 6 shows the detailed circuit configuration of FIG. 4. FIG. 7 shows another embodiment of the present invention in which the transmission path is divided into a control transmission path and a data transmission path. M ₁ ~M _N ……Common microcomputer, SC
... Spare microcomputer, BC ... Transmission line control circuit, S ₁ to S _N ... Input/output control circuit, 10
...Data file memory, 11...Transmission line.

Claims (1)

[Claims] 1. A common transmission path, a plurality of regular microcomputers connected to the transmission path, at least one standby microcomputer, and a plurality of input/output control circuits connected to the transmission path. a transmission line control circuit that controls the exchange of information between the regular microcomputer, the standby microcomputer, and the input/output control circuit; The transmission line control circuit includes a data file memory that collectively stores input/output status data and calculation result data, and the transmission line control circuit controls the input/output data that changes from time to time, which the common microcomputer performs calculations on from the common transmission line. The state data and the operation result data calculated by each of the regular microcomputers are taken in and the memory contents at a predetermined location in the data file memory are updated, and when any of the regular microcomputers breaks down, the data is transferred to the failed regular microcomputer. comprising means for transmitting a corresponding program and data from the data file memory to the standby microcomputer via the transmission line, and outputting a control signal instructing to back up the failed microcomputer; A redundant system control device characterized in that a spare microcomputer is made to back up the failed microcomputer.