JPH0327923B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to an improvement of an n+1 redundant control device.

A distributed control device is a system in which a plurality of intelligent control stations are distributed at various locations to be controlled and connected through communication lines, so that each control station is assigned control over its own area. Such a device is a risk-distributed control device and has high reliability as a system, but just because the individual control stations are distributed does not mean that the reliability is increased. Therefore, when high reliability is required for each individual control station, redundancy of each control station is required.

From an economic point of view, the redundancy method is to provide one standby control station for a given number of control stations, and when one of the control stations on the active side fails, the control station on the standby side is activated. So-called n+1 redundancy, in which backup is performed at the station, is employed. In that case, it is necessary to inherit input/output signals and control databases between the production-side control station and the standby-side control station in order to ensure smooth handover of control during backup and release. become.

A conventional example of a distributed control device with n+1 redundancy for control stations is a dedicated system for transmitting and receiving process input/output signal lines for each control station between the active control station and the standby control station. Some are equipped with connection means. In such a conventional example, since it is necessary to switch a large number of input/output signal lines, the switching means becomes complicated and reliability decreases.Furthermore, the control station on the standby side is It must have all the same input and output parts as the control station on the side, so
Not economical. Or, conversely, the possible input/output units of the control station on the active side are limited by the input/output units of the control station on the standby side. Furthermore, it is uneconomical that a dedicated connection line for transmitting and receiving the database is required between the n+1 control stations in a redundant relationship. Furthermore, when the standby control station takes over the database during backup, the production control station has already failed, so the database may have been damaged due to runaway intelligence. There is sex. Correct control may not be possible depending on the damaged database, so
It is necessary to inherit a database that does not pose such a risk.

An object of the present invention is to eliminate the need for switching process input/output lines when taking over control between n+1 control mechanisms in a redundant relationship, eliminate the need for a dedicated connection line for database exchange, and eliminate the need for actual connection between n+1 control mechanisms. To provide a redundant distributed control device capable of taking over a database whose normality is guaranteed even in the event of a failure on the side.

The present invention is an n+1 redundant control device having a configuration in which a plurality of process control units having intelligence and input/output units and a redundant unit having intelligence are connected by communication lines, and each process control unit is a watchdog.
The redundant unit has a means for indicating a failure according to the time-up of the timer, and as a storage means for the database uploaded from the process control unit, the redundant unit has a capacity larger than that for storing the databases of all the process control units connected to the communication line. , a storage means with a capacity large enough to store at least the database uploaded at a time corresponding to the time limit of the watchdog timer of the process control unit, and all process control units connected to the communication line to this storage means. uploading means for periodically and sequentially and circularly storing a database of the process control unit; and means for controlling the process by making full use of the input/output section of the process control unit instead of the intelligence of the process control unit using the database of the process control unit. This goal has been achieved.

Hereinafter, the present invention will be explained in detail with reference to Examples. FIG. 1 is a conceptual configuration diagram of a distributed control device to which the present invention is applied. In Figure 1, 1 ₁ ~
_1K is a control station, each of which has intelligence and controls each part of the object to be controlled. Master stations 2 ₁ to 2 _n are provided for monitoring and operating the entire system by an operator or a host computer.
3 is a communication line, which connects control stations 1 ₁ to
1 _K and master stations 2 ₁ to 2 _n are connected to form a distributed control device.

The detailed configuration of the control station 1 _i (i=1 to k) is shown in FIG. In Figure 2, 4 ₁ to 4
n is a process control unit, 5 is a cluster control unit, 6 is a redundant unit, and 7 is an internal communication line. The process control units 4 ₁ -4n, the cluster control unit 5 and the redundancy unit 6 are interconnected by an internal communication line 7 and constitute one control station. Such control stations are called clusters due to their shape. Each cluster is connected to a communication line 3 through a cluster control unit 5.

The process control units 4 ₁ to 4n, the cluster control unit 5 and the redundancy unit 6 all have intelligence, for example, as shown in FIG.
They are constructed as shown in FIGS. 4 and 5, respectively.

In FIG. 3, the process control unit 4 _j
(j=1 to n) has an internal communication controller NCM, a processor NPU, a memory NMU, and an input/output device I/O. Each of these components is interconnected by a data bus DBS,
It forms an intelligent process control unit. The Pusetsa NPU and memory NMU form the core of intelligence. Input/output data is stored in the memory NMU, and processed by the processor NPU.
Data processing for process control is performed. When processing data, the database in the memory NMU is used, and data processing appropriate for the process that this unit is in charge of is performed.

The internal communication controller NCM has a function of controlling communication to the internal communication line 7 and accessing the memory NMU and the input/output device I/O by direct memory access (DMA). Such functions are realized by a microprogram built into the communication controller NCM.

The cluster control unit 5 in FIG. 4 also has a similar internal communication controller NCM, processor NPU, and memory NMU, and also has an external communication controller FCA. External communication controller
FCA also has a DMA function. Each of these components is also interconnected by a data bus DBS to form an intelligent cluster control unit. This cluster control unit uses its intelligence to control the operation of each unit within the cluster. There are two types of control: one is to control each unit in the cluster based on commands given from the master stations 2 ₁ to 2 _n through the communication line 3, and the other is to , to cause the redundant unit 6 to back up the failed process control unit _4j based on the failure communication signal communicated from the process control unit _4j .
All of these controls are performed through communication using the internal communication line 7. In that case, the processor NPU processes data for control, the internal communication controller NCM controls communication to the internal communication line 7, and the external communication controller FCA controls the communication to the external communication line 3.
Control communication to.

The redundant unit 6 in Fig. 5 also has a similar internal communication controller NCM, processor NPU, and memory NMU, and also has an upload memory.
Have NMUU. These components are also interconnected by a data bus DBS to form an intelligent redundancy unit 6. This redundant unit 6 uses its intelligence to periodically read out the database of all process control units 4 ₁ to 4n in the cluster via communication and store it in the upload memory NMUU. The latest database of each process control unit _4j always exists in the upload memory NMUU.
The database is collected by the internal communication controller in the redundant unit 6 and each process control unit _4j .
This is done periodically by the NCM's DMA function.
By monitoring the behavior of the redundant unit 6 during database collection by the master control unit 5, the health of the redundant unit 6 in the standby state can be confirmed. Therefore, backup can be performed in a redundant unit whose integrity is guaranteed.

The upload memory NMUU is provided with upload areas corresponding to each of the process control units _4j . The number of upload areas is greater than the number of process control units _4j . For example, if the number n of process control units is 8, the upload area is the 6th one.
It is configured as shown in the figure.

In FIG. 6, upload areas are provided twice as many as the number of process control units, and databases for the corresponding process control units are uploaded to each area. Uploading is performed in order, and at the current time _t0 , the database of the process control unit ₄₅ has been uploaded. The databases in other areas were all uploaded before that time, and the negative subscript of the symbol indicating the point in time indicates the degree of backwardness from the current point. If the time required to upload a database per time is t, then the database in each area is older than the index times t. The required time t for uploading is, for example, about 1.5 seconds. Since the number of areas is twice the number of process control units, there are two databases for each process control unit _4j that differ by one period at the time of collection.

A failure in each process control unit _4j is detected by the time-up of a watchdog timer built in each, and a failure notification based on the time-up is transmitted to the cluster control unit 5 by communication. The time limit T of the watchdog timer is set to the same value for all process control units 4 ₁ -4n, for example, about 4 seconds.

When cluster control unit 5 confirms that a process control unit has failed, it instructs redundant unit 6 to back it up.

The redundant unit 6 performs backup of a failed process control unit according to instructions from the cluster control unit 5.

The database used for data processing during backup is selected from those previously uploaded as follows, and is transferred to the main memory for use.

Now, suppose that the process control unit ₄₂ has failed and its backup is ordered at time _t0 in FIG. 6, and at this time the redundant unit 6 happens to be uploading the database of the process control unit ₄₅ . The unit 6 employs, as the database of the process control unit ₄₂ , a database that is past the time limit T of the watchdog timer from time _t0 . Now, the database of the process control unit ₄₂ has two data at time t _-3 and time t _-11 .
is uploaded, but if time t _-3 is at a position equal to or greater than the time limit T of the watchdog timer, then the database at time t _-11 is adopted.

Position within watchdog timer time limit value
The fact that there is a database at t _-3 means that a failure has already occurred in the process control unit ₄₂ when it is uploaded, so the database at that point is
It may have been destroyed by a runaway processor. Therefore, avoid databases that pose such a risk, and use databases that are certain to be correct, preferably from the past. Note that t=1.5,
In the case of T = 4, the time of t = _-3 is -4.5 seconds,
Although it is slightly outside the point value of the watchdog timer, it is a critical point so it is better to avoid using it. In reality, it is appropriate to set the distance at least 1.5 times the time limit value of the waiting timer.

In order to make the above possible, the number of upload areas is greater than the number of process control units _4j , but as shown in Figure 6, the number of upload areas is twice the number of process control units. However, it is sufficient that the number of databases is greater than the number of process control units _4j and can accept a plurality of databases uploaded within the same time as the watchdog timer's time limit T or a value with some margin above it. Since the number of databases uploaded to a song for the same time as the time limit T of the watchdog timer is T/t, the number of upload areas may be an integer greater than or equal to n+T/t.

In the example shown in FIG. 6, since n=8 and T/t=2.7, the number of upload areas should be 11, but it is set to 12 to provide a margin. In this case, upload areas 0 and 13 to 15 are essentially unnecessary. However, with this part, the number of upload areas is twice the number of process control units,
Advantageously, each upload area corresponds fixedly to each process control unit. On the other hand, if the number of upload areas is 12, the database uploaded to each area changes cyclically in accordance with the upload cycle, as shown in FIG.

Backup is performed by the intelligence of the redundant unit 6 making full use of the input/output device I/O of the process control unit ₄₂ via communication using the database adopted as described above. That is, the intelligence of the redundant unit 6 performs the backup in place of the intelligence of the process control unit ₄₂ . Since the process control unit ₄₂ has an internal communication controller NCM having a DMA function, it is possible to make full use of such input/output devices I/O. In other words, backup can be performed without any need to switch the input/output device I/O signal lines. For this reason, the redundant unit 6 is connected to the process control unit 4.
It is not necessary to have the _same input/output device I/O as that of process control unit ₄₂ .
You are not prevented from freely having the input/output device I/O that you need.

During backup, process control unit 4 ₂
Database collection for other items is performed periodically. Since the collection of the database and the internal communication line 7 for internal control of the cluster are carried out through communication, a dedicated connection line is not required.
The database also includes process control unit 4 ₂
Since the data read while the database is normal is used, the normality of the database is guaranteed. Therefore, the so-called co-collapse phenomenon in which an abnormal database is taken over from the failed process control unit ₄₂ and the backup itself becomes abnormal can be easily prevented.

During backup, process control unit 4 ₂
Repair or replacement of faulty intelligence will be carried out. The intelligence, which has recovered its normal function through repair or replacement, generates a function recovery signal (ready signal). When this signal is communicated, the cluster control unit 6 recognizes the functional recovery of the intelligence of the process control unit ₄₂ and instructs the redundant unit 6 to release the backup, either automatically or according to the manual operation of the operator. do.

According to this command, the redundant unit 6 replaces the process control unit 4 in the uploaded memory NMU.
₂ is copied to the database area of the memory NMU of the process control unit ₄₂ via communication, and then the intelligence is activated to escape from the backup.

FIG. 8 shows another embodiment of the invention. This embodiment makes communication systems inside and outside the cluster redundant,
This further increases reliability. That is, two external communication lines 3 ₁ and 3 ₂ are provided, and two internal communication lines 7 _{1 and} 7 ₂ are provided, and correspondingly, the cluster control unit 5 has an external communication control line. There are two systems each for the controller FCA and the internal communication controller NCM, and the process control unit 4
₁ to 4n and the redundant unit 6 have an internal communication controller.
Two NCM systems will be provided.

Although the present invention has been described above with reference to preferred embodiments, the present invention may have various embodiments within the scope of the claims.

[Brief explanation of the drawing]

FIG. 1 is a conceptual block diagram of a distributed control device to which the present invention is applied, FIG. 2 is a conceptual block diagram of an embodiment of the present invention, and FIGS. 3, 4, and 5 are respectively A detailed configuration diagram of a part of FIG. 2, FIGS. 6 and 7 are conceptual configuration diagrams of upload memory,
FIG. 8 is a conceptual block diagram of another embodiment of the present invention. 1 ₁ to 1 _k ...control station, 2 ₁ to 2 _n ...
Master station, 3...Communication line, 4 ₁ to 4
n...Process control unit, 5...Cluster control unit, 6...Redundant unit, 7...Internal communication line.

Claims (1)

[Scope of Claims] 1. An n+1 redundant control device having a configuration in which a plurality of process control units having intelligence and input/output units and a redundant unit having intelligence are connected by a communication line, Each process control unit has a watchdog
The redundant unit has a means for indicating a failure according to the time-up of the timer, and as a storage means for the database uploaded from the process control unit, the redundant unit has a capacity larger than that for storing the databases of all the process control units connected to the communication line. , a storage means with a capacity large enough to store at least the database uploaded at a time corresponding to the time limit of the watchdog timer of the process control unit, and all process control units connected to the communication line to this storage means. uploading means for periodically and sequentially and circularly storing a database of the process control unit; An n+1 redundant control device, comprising means for controlling a process by making full use of the input/output section of the process control unit instead of the intelligence of the process control unit using the database of the process control unit.