JPH0439741A - Controller for redundant computer system - Google Patents

Abstract

PURPOSE:To eliminate the need of a signal from a redundant control part and to execute the control by two signal lines by operating an interlock circuit through an OR circuit by outputs of two AND circuits for inputting a CPU stop signal and a CPU control mode signal and outputting a CPU control signal, provided in the computer concerned, respectively. CONSTITUTION:The controller is provided with a redundant control part for applying a CPU stop signal to a faulty computer of one of a primary computer 1P or a reserve computer 1R,a nd outputting a control right signal to the other sound computer. Also, an AND circuit for inputting a CPU stop signal (negative logic) and a CPU control mode signal (positive logic) and outputting a CPU control signal is provided in the computers concerned, respectively, and an interlock circuit 2 for receiving outputs of two AND circuits thereof as a control stop signal through an OR circuit is provided. In such a way, a signal line outputted to the outside from the redundant control part becomes unnecessary and the control is executed by two pieces of signal lines.

Description

[Detailed description of the invention] [Industrial application field]

The present invention relates to a control device for a redundant computer system consisting of a dual system of a primary computer and a reserve computer.

[Conventional technology]

FIG. 4 is a conceptual diagram of a process control system including redundant computers; in the figure, 1 is a redundant computer, 2 is a redundant computer;
is the control stop signal (SYSD) output from redundant computer 1
3 is a process control device that is controlled by the process control signal (PC) of the redundant computer 1 and outputs a process state variable (PJ). Also,
FIG. 5 is a configuration diagram of a redundant computer system showing the configuration of the redundant computer 1 in FIG. 4 in further detail.
P and IR are the primary computers and reserve computers that constitute the redundant computer 1, and 4 is the control stop signal (SYSD).
This is a control stop signal generating means that outputs a signal (WN). Next, the operation will be explained. Generally process control equipment 3
The control computer extracts the process state variable (P
J) When receiving (temperature, pressure, etc.), it performs calculations according to preset algorithms and parameters, and has the function of outputting the calculation results to the process control device 30 equipment (valves, relays, etc.) for control. ing. Therefore, if the control computer of this process control device 3 fails, the process cannot be controlled and the process state variable (PJ
) may become abnormal and sometimes destroy the target process. Normally, process computers have very important functions for process operation, so consideration is given to designing them so that they are less likely to malfunction. The reserve (standby redundancy) computer IR is used as one means of increasing its reliability. In other words, usually the primary (operating side) computer IP
is controlling process 3. At this time, the reserve computer IR takes in the same contents as the primary computer (IP) regarding the process status (PJ) and parameters necessary for the control calculation so that it can start control at any time. If the primary computer IP fails in this state, the reserve computer IR takes over control and controls the process control device 3 without interruption. Even in such a standby redundant computer system, in the worst case, both the primary computer IP and the reserve computer IR may fail. At this time, the process control stops, so the control on the computer side (SYSDWN
) is input to a specially prepared interlock circuit 2, and this interlock circuit 2 stops the operation of the process control device 3 while maintaining safety. For example, the interlock circuit 2 performs sequential operations such as gradually closing the valves of the fuel system that supplies the fuel to the burner. Next, specific circuit operation will be explained with reference to FIGS. 5 and 6. First, the redundant computer l sends a primary side CPU stop (watchdog timer) signal (PWDT) indicating that the CPU of the primary computer IP is stopped, and a CPU of the reserve computer IR to the control stop signal generation means 4. The reserve side CP indicates that the
Three signals are input: a U stop (watchdog timer) signal (RWDT) and a reserve side control right (SAVE) indicating that the reserve computer IR has the control right. Therefore,
In normal operating conditions, as shown in Figure 6, the primary side CPU stop signal (PWDT) and the reserve side CP
The U stop signal (RWDT) is both logic ``1'' and the reserve side control right (SAVE) is logic ``0'', so the primary side CPU control of the control stop signal generation means 4 (PCTL
) is “1” RESURF side CPU! III (RCTL)
is "O" and the control stop signal (SYSDWN) is "1°'"
That is, the primary computer IP is operating. Here, when a failure occurs in the primary computer IP at time t1, (PWDT) is reversed from "°1" to "0". Due to this signal change, the output PCTL of the AND circuit ANDI is switched from "1" to "0"' at time t2. Since the redundancy control unit (UAC) receives the primary side stop signal (PWDT) from the primary computer IP at the same time, it acquires the reserve side control right (SAVE) at time t3.
is immediately reversed from °“0°゛” to 1. Also, at t4, the reserve side CPU control (RCTL) is changed from "°0" to "°1".
Since the output of the ANDI is switched to 0, the output of the logical product ANDI is 0, and the output of AND2 is 1. Control stop signal (SYDWN) which is the output of the logical sum circuit OR
Actually, there is almost no change, but a control stop signal may be generated temporarily depending on the timing of the CPU clock. In this case, it will automatically return after the switching time has passed.

[Problem to be solved by the invention]

Since the control device of the conventional redundant computer system is configured as described above, three signal lines are required between the redundant computer and the control stop signal generating means, and a logic circuit is required within the control stop signal generating means. However, there were issues such as unfavorable wiring and price structure. This invention was made to solve the above-mentioned problems, and it eliminates the need for signals from the redundant control unit and uses two signal lines, and also connects the CP from the primary computer and the reserve computer.
The object of the present invention is to obtain a control device for a redundant computer system that can obtain a system stop signal by simply ORing "1" with a U stop signal (usually a signal under CPU control).

[Means for Solving the Problems] A control device for a redundant computer system according to the present invention includes a primary computer that obtains control rights on the primary side and continues normal operation, and a primary computer that continues normal operation when a failure occurs in the primary computer. If a failure occurs in either the primary computer or the reserve computer, which switches the control authority to the reserve computer and continues operating in place of the primary computer, the failed computer is given CP.
A redundant control unit that gives a U stop signal and outputs a control right signal to the other healthy computer, and a CPU of each corresponding computer provided in the primary computer and reserve computer.
Stop signal (negative logic) and CPU control mode signal (positive logic)
and an interlock circuit that receives the output of the two AND circuits as a control stop signal via an OR circuit. [Operation] The redundant computer according to the present invention is provided with an AND circuit in which the CPU computer stop signal (negative logic) and the CPU control mode signal (positive logic) are input, respectively, in the primary computer and the reserve computer. Input the two types of signal lines output from the product circuit into an OR circuit, give the output of the OR circuit to the interlock circuit as a control stop signal, and calculate the number of signal lines output from the redundant computer to the outside of the machine. Try to reduce it.

[Embodiments of the invention]

An embodiment of the present invention will be described below with reference to the drawings. In FIG. 1, parts that are the same as those in FIG. , the signals on both signal lines are ORed (positive logic) by the control stop signal generating means 4 and the output is inputted to the interlock circuit 2 as a control stop signal (YSDWN). Next, the operation shown in FIG. 1 will be explained with reference to the time chart shown in FIG. First, under normal operating conditions, primary side C
PU stop signal (positive logic) (PWDT), primary side C
Both PU control modes (positive logic) (PAC'T') are 1°", so the primary side CPU is under control (PC
TL) (output of logical product A N D 1 r) is “1”,
Therefore, the output of the (positive logic) OR is naturally also "1". Therefore, at time t1, when a failure occurs in the primary computer, (PWDT) changes from "1" to 0, but (PACT) remains "1", so naturally (PC
TL) is inverted from 1'' to 0''. At this time, from the redundant control unit (UAC), (SAVE) switches from "1" to "0" due to the change of the (PWDT) signal from "1" to "0", and the primary side control (PCTL) is switched off. 1” to “0”
However, instead, (SAVE) for reserve calculation @IR switches from °°0" to "1", so at time t3, the reserve side CPU control signal (RAC
T) changes from "0°" to "1'', and the reserve computer IR acquires the control right and enters the control mode. At time t4, the CPU on the read and reserve side is under control (R
CTL) goes from 0 to 1, the control stop signal (SY
SDWN) continues to output as is. However, even in this case, as mentioned above, the control stop signal (SYSDW
N) may be output, but it will automatically return after the switching time has elapsed. FIG. 3 is a block diagram showing another embodiment of the present invention, in which the OR circuit OR of the control stop signal generating means 4 shown in FIG. 1 is connected using a photo coupler (PC). In this case, only one signal line from the redundant computer 1 needs to be manually connected to the interlock circuit.

【Effect of the invention】

As described above, according to the present invention, the CPU computer stop signal (negative logic) and C
PU! An AND circuit that receives the II control mode signal (positive logic) as input is provided, two types of signal lines output from the AND circuit are input to an OR circuit, and the output of the OR circuit is interlocked. Since it is given to the circuit as a control stop signal, there is no need for a signal line output from the redundant control unit to the outside, and control can be performed with two signal lines, and wired
By performing an OR operation, it is also possible to use an I signal line, which simplifies wiring and reduces the number of wiring steps, resulting in an inexpensive device.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing the configuration of a redundant computer system according to one embodiment of the present invention, FIG. 2 is a time chart for explaining the operation sequence of FIG. 1, and FIG. 3 is another embodiment of the present invention. Figure 4 is a conceptual diagram of a process control system including a general redundant computer; Figure 5 is a block circuit configuration diagram showing the
The figure is a block diagram showing a conventional redundant computer system.
FIG. 6 is a time chart for explaining the sequence of operations shown in FIG. In the figure, IP is the primary computer, IR is the reserve computer, UAC is the redundant control unit, and ANDI PAN
D2R is an AND circuit, OR is an OR circuit, 2 is an interlock circuit, and 4 is a control stop signal generating means. In addition, in the figures, the same reference numerals indicate the same or equivalent parts. (2 others) Figure 2 1t2 ts5*

Claims (1)

[Claims] A primary computer that obtains control rights on the primary side and continues normal operation, and a reserve computer that switches control rights on the primary side to control rights on the reserve side and continues operation in place of the primary computer when a failure occurs in the primary computer. a redundant control unit that, when a failure occurs in either the computer, the primary computer, or the reserve computer, gives a CPU stop signal to the failed computer and outputs a CPU control mode signal to the healthy computer; An AND circuit is provided in the computer and the reserve computer, and receives a CPU stop signal and a CPU control mode signal of the corresponding computer as input, and outputs a CPU control signal;
A control device for a redundant computer system, comprising an interlock circuit that receives the outputs of the two AND circuits as a control stop signal via an OR circuit.