JPH0630002A - Redundant system - Google Patents

Abstract

PURPOSE:To early detect a fault for improvement of the reliability of redundant system by providing a test frame transmitter means and returning an external loop-back frame to a communication circuit when a test frame is received in a stand-by station. CONSTITUTION:The controller of the stand-by side has a transmission request for an external loop-back frame. A test frame transmitter means 12 of the controller of the control side sends a test frame to the controller kept in a stand-by state. When a normal answer of the test frame is received from the controller of the stand-by side, the means 12 transfers a token to the stand-by side. An external loop-back frame transmitter means 13 of the stand-by side transmits the external loop-back frame when the token is received. The stnd-by side receives the external loop-back frame that is once sent to a communication circuit and then returned and then sends the token back to the control side. In such a constitution, the fault detected at the control side is defined as an error by a periodical external loop-back test and can be detected.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a redundant system applied to a distributed control system for controlling a process, and more particularly to a redundant system connected between a plurality of control devices connected to a communication line and distributed. The present invention relates to a system for performing communication control of a token path system that realizes communication using a communication line by sequentially carrying communication rights (tokens), and to a redundant system having a function of self-diagnosing the communication function.

[0002]

2. Description of the Related Art In a distributed control system used for process control, in order to improve its reliability,
The control device has a dual configuration (redundancy), one of which is the control side,
The other side is used as a standby side to prepare for the failure of one side. In such a redundant system, the self-diagnosis function of the communication function has a function of checking an abnormality between the software and the firmware and a control side of the apparatus on the control side and the apparatus on the standby side, respectively. It is necessary to check the communication between the standby side.

FIG. 3 is a structural conceptual diagram showing an example of this type of redundant system. In the figure, FCS11, FC
S12 is, for example, a control device having a redundant configuration (duplex configuration) for controlling the processes, both of which are connected to the communication line BUS via the coupler CPL. This controller FCS
Of the 11 and FCS 12, one is on the control side and the other is on the standby side. Although not shown in the communication line BUS,
Other distributed control devices and operation monitoring devices (operator stations) are connected.

Firmware and software are provided in each of the control devices FCS11 and FCS12.
With these, various control calculation functions for controlling the process, a communication function using a communication line, and the like are configured.

In such a redundant system, as the self-diagnosis of the communication function, conventionally, (a) an internal loopback test on each of the control side and the standby side, and (b) an increment pattern from the control side to the standby side. The two methods of writing test communication were used in combination.

4 and 5 are conceptual diagrams of the loopback test. There are two types of this loopback test, as shown in FIG. 4, an internal loopback for returning the communication frame in the communication control firmware, and as shown in FIG. 5, once the communication frame is once put out on the communication line. There is an external loopback that wraps at.

[0007]

However, since the self-diagnosis shown in FIG. 4 performs only the internal loopback, the self-diagnosis shown in FIG. There is a problem that it is difficult to detect external abnormalities.

On the other hand, the self-diagnosis shown in FIG. 5 can detect an external abnormality, but has a problem that it is not possible to specify which part actually fails.
Also, in order to perform an external loopback, since the transmission can be performed only when the communication right (token) comes around to the self, on the standby side, which normally does not perform communication,
There was a problem that the external loopback test could not be performed because the token was not given.

The present invention has been made in view of the above circumstances, and enables an external loopback test to be executed even in a system on the stand-by side and has a self-diagnosis function capable of identifying a failure point and having reliability. The purpose is to provide a highly redundant system.

[0010]

SUMMARY OF THE INVENTION The present invention which solves such a problem is a redundant system in which a control device having a token path type communication control function is provided in a redundant configuration. Test frame transmitting means for transmitting a test frame to the control device side on the standby side via the communication line and temporarily passing the token when the token comes around to the control device on the control side. And the external loopback frame transmitting means for transmitting the external loopback frame toward the communication line when the test frame is received in the standby side. .

[0011]

[Function] When an external loopback test is to be performed, the test frame communication means of the control device on the control side is
The test frame is transmitted to the control device on the standby side via the communication line and the token is temporarily passed.

Upon receipt of the token, the control device on the standby side can communicate using the communication line, and in response to receiving the test frame, transmits the external loopback frame to the communication line.

The loopback test using the external loopback frame is a communication test in which a frame is once put out from the standby side control device onto the communication line and returned, and an abnormality in the system including the communication line can be detected on the standby side.

[0014]

Embodiments of the present invention will now be described in detail with reference to the drawings. FIG. 1 is a configuration block diagram showing an embodiment of the present invention. In the figure, FCS11 and FCS12 are, for example, a control device of a redundant configuration (duplex configuration) for controlling a process, and CPL is a communication line B duplicated with each control device.
It is a coupler provided between the US and the US.

Each control unit FCS11, FCS12 is provided with various control calculation functions for controlling the process, which are not shown in the figure. One is a control side involved in the control operation and the other is a failure of one side. It is a standby side to stand by in preparation for the situation, and the two control devices use a well-known method so that when the device on the control side fails, the two control devices have a CPU so that the standby side can enter the control state at any time. It is assumed that communication and database equalization have been performed.

In each control device, 11 is a communication means for performing communication control by performing token pass type communication, and 12 is a standby side when a token comes around to the control side. Test frame transmitting means for transmitting a test frame to the control device side via the communication line BUS and temporarily passing a token, and when 13 receives the test frame in the standby side,
It is an external loopback frame transmitting means for transmitting a loopback frame on the communication line BUS and then returning the loopback frame.

The operation of the system thus constructed will be described below. FIG. 2 is a conceptual diagram showing a procedure of an external loopback test on the standby side, which is a feature of the present invention. Here, the following symbols correspond to the symbols shown. (A) The control device on the standby side is normally set to the interrupt disabled state, but permits the interrupt from the firmware when performing a test. (B) The control device on the standby side first requests the transmission of the external loopback frame. However, the control device on the standby side waits until the token is handed to itself from the control device without transmitting. (C) Test frame transmitting means 12 of the control device on the control side
Transmits a test frame to the control device on the standby side. (D) When the normal response of the test frame is returned from the control device on the standby side, the test frame transmitting means 12 in the control device on the control side subsequently passes the token to the control device on the standby side. (E) The external loopback frame transmitting means 13 of the control device on the standby side, at the time point when the token is passed, (b)
The external loopback frame that was in the waiting state at the point of is transmitted. (F) The control device on the standby side receives the external loopback frame that returns to the communication line and then returns,
Return the token to the control unit on the control side. (G) In the control device on the standby side, interrupts from the firmware are prohibited.

Behavior in the case where some kind of failure occurs in such a procedure will be described below according to the content of the abnormality. (When the token cannot be passed to the standby side due to an abnormality in the transmission / reception part of the communication means on the control side) An abnormality in the control device on the control side can be detected as an error in the fixed-cycle external loopback test on the control side .

If an external loopback test is performed on the standby side after the failure on the control side and before the operation is switched to the CPU on the standby side, the token cannot be passed to the standby side. At this time, the standby side cannot transmit the external loopback frame forever, resulting in a timer over error, but at this time, the standby side error is not generated.

Even in this case, if an error occurs in the transmission of the external loopback frame on the standby side for several times in succession, naturally, the standby side is also abnormal. At this time, the control side outputs a message of a test communication error or a token path error to the standby side, and such an abnormality can be determined.

(When the receiving side on the control side or the transmitting side on the standby side has an abnormality and the token is handed to the standby side, but the control side retries) External loopback transmission on the standby side While receiving a retry token from the control side, the loopback becomes an error. However, if the standby side is not regarded as abnormal by one error, and if an error occurs in the transmission of the external loopback frame on the standby side several times in succession, it is naturally judged that the standby side is abnormal. .

(When there is an abnormality in the transmission unit on the standby side) In many cases, the test communication from the control side causes an error, and the token cannot be received on the control side. Therefore, the external loopback frame cannot be transmitted on the standby side. Therefore, a time-out error occurs.

At this time, if the standby side is not considered to be abnormal by one error and an error occurs in the transmission of the external loopback frame on the standby side several times in succession, naturally the standby side is abnormal. Judge that there is.

If the token is passed after passing the check in the test communication, an error will occur in the external loopback test on the standby side, but the token cannot be returned to the control side. When worrying about such a slight possibility, the control side monitors the return of the token when an error occurs in the loopback of the standby side, and if the token does not return for a certain period of time, the control side voluntarily May be provided.

(When there is an abnormality in the receiving unit on the standby side) Immediately after the abnormality, an error occurs in the external loopback test on the standby side. If an error occurs at any other timing, the test communication fails or the token is not passed, so the standby side cannot execute loopback.

As described above, when an error is detected in the test communication and the external loopback test on the standby side, if the error occurs several times in succession, the standby side is determined to be an error.

When the control side is abnormal, after passing the token to the waiting side, the token is monitored so as not to disappear.

[0028]

As described above in detail, according to the present invention, an external loopback test can be performed on the standby side as well, so that such a test is performed at regular intervals on the standby side in the hot standby state. As a result, it becomes possible to detect the failure at an early stage, the location of the failure can be easily identified, and a highly reliable redundant system can be realized.

[Brief description of drawings]

FIG. 1 is a configuration block diagram showing an embodiment of the present invention.

FIG. 2 is a conceptual diagram showing a procedure of an external loopback test on a standby side, which is a feature of the present invention.

FIG. 3 is a structural conceptual diagram showing an example of this type of redundant system.

FIG. 4 is a conceptual diagram of a loopback test.

FIG. 5 is a conceptual diagram of a loopback test.

[Explanation of symbols]

FCS11, FCS12 Control device of redundant configuration (duplex configuration) CPL coupler BUS communication line 11 communication means 12 test frame transmission means 13 external loopback frame transmission means

Claims (1)

[Claims] 1. In a redundant system in which a control device having a token pass type communication control function is configured in a redundant manner, in each control device, a token is circulated to itself while being on the control side. When sending a test frame to the control unit on the standby side, the test frame is transmitted through the communication line and the token is temporarily passed, and the test frame is transmitted on the standby side. An external loopback frame transmitting means for transmitting an external loopback frame to the communication line upon reception is provided.