JPH113240A - Control computer system - Google Patents

Abstract

(57) [Summary] (With correction) [PROBLEMS] A computer system for redundant control that can change a system program without affecting a control target. An operation of a processor unit on a control side is continued, an operation of a processor unit on a standby side is stopped,
Load means for loading a new system program into the standby processor unit, and activation for instructing the control input / output unit of the control processor unit to hold control data, and then activating the standby processor unit Means for copying application data in the processor unit on the control side to the processor unit on the standby side; and stopping means for self-stopping the processor unit on the control side after the above is completed. When the unit self-stops, the standby processor unit starts up as a new control processor unit.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a control computer system in which a duplicated processor unit is mounted on a control computer, and one of the duplicated processor units is operated as a control side and the other is operated as a standby side. More specifically, the present invention relates to a computer system devised for changing a system program online.

[0002]

2. Description of the Related Art In a control computer system, a processor, a memory, and an
By making the components such as the / O card redundant, the influence of the failure can be avoided. But the processor,
Since functions such as a memory and an I / O card are based on the premise that a system program such as an operating system (hereinafter referred to as OS) operates stably, when the system program fails, the system is stopped. I had to accompany it. By the way, in a control computer system used for process control, etc., the stop of the system is allowed only at a very limited timing and time due to the nature of the control target, and high reliability is required. It is indispensable to quickly repair a failure. As described above, the control computer system used for the process control or the like requires high reliability and high availability, but it is practically difficult to repair the failure of the core software such as the OS. There was a point. Here, high availability means that operation is possible at a high operation rate.

[0003]

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and it is intended to continue the operation of the processor unit on the control side, stop the operation of the processor unit on the standby side, and stop the operation. An object of the present invention is to realize a control computer system capable of changing a system program without affecting a control target by loading a new system program into a storage unit of the standby processor unit.

[0004]

SUMMARY OF THE INVENTION The present invention is a control computer system having the following configuration. (1) In a control computer system in which a duplicated processor unit is mounted on a control computer and one of the duplicated processor units operates as a control side and the other as a standby side, each processor unit stores a system program and application data. Operation control for controlling the processor unit on the control side and stopping the operation of the processor unit on the standby side when the system program is changed when the system program is changed. Means, load means for loading a new system program into the storage unit of the stopped standby processor unit, and control data stored in the control input / output unit of the control processor unit without data update from the processor unit To wait, and then wait Activating means for activating the processor unit; copying means for copying application data stored in a storage unit in the control processor unit to a storage unit in the standby processor unit; and control data to the control input / output unit Stopping means for self-stopping the control-side processor unit after the holding and the copying of the application data are completed, and when the control-side processor unit self-stops, the standby-side processor unit A control computer system which is activated as a processor unit. (2) The control computer system according to (1), further comprising operation restriction means for preventing the processor unit started as the new control side from executing an operation that hinders control continuity.

[0005]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below in detail with reference to the drawings. FIG. 1 is a configuration diagram showing one embodiment of the present invention. In FIG. 1, 1 is a control computer, 2 is a system generation computer, and 3 is a communication bus to which the control computer 1 and the system generation computer 2 are connected.

In the control computer 1, 10a and 10b are duplicated processor units. The processor units 10a and 10b have the same configuration,
1 and a storage device 12. Data can be transferred between the processor units. The storage device 12 stores a system program. The system program operates on the processor unit and includes a boot processing program, an OS, and a control program. Two processor units 10a and 10b
Are executing the same program while synchronizing the processing timing with each other, but one of them is performing control input / output, and the side that actually performs control input / output is the control side, and the other is the standby side. ing. 13a and 13b are duplicated control input / output units. Control input / output units 13a and 1
3b has the same configuration, mediates between the processor unit and the control device, and transmits and receives control input / output data.

[0007] The system generating computer 2 generates a system program of the control computer, application data, and the like.

FIG. 2 is a diagram showing a specific configuration example of the system of FIG. In FIG. 2, the storage device 12 includes a ROM (read only memory) 121 and a main storage device 122.
The boot program is stored in the ROM 121 in the main storage device 1.
22 stores an OS, a control program, and application data. The boot program is a program for performing startup processing of a computer. The OS is loaded into the main storage device 122 by executing a boot program, and realizes a redundancy function by executing this program. The control program runs on the OS, and realizes a control function by executing this program.

The system generating computer 2 is a storage device which stores a system program changing program (hereinafter referred to as a changing program). The change program operates on the system generation computer 2 and executes the change of the system program in cooperation with software on the control computer 1 via the communication bus 3. The application data is a database for a control program. The application data includes process input / output values and the like, and is constantly updated by the control program.

Reference numeral 22 denotes a processor. Processor 22
221 is used to change the system program.
Operation control means for continuing the operation of the processor unit on the control side and stopping the operation of the processor unit on the standby side. Reference numeral 222 denotes a load unit for loading a new system program into the storage unit of the stopped standby processor unit via the communication bus 3; This is an activation unit that instructs to hold the control data even if the processor unit is not present, and then activates the standby processor unit. A copying unit 224 copies (equalizes) application data stored in the storage unit of the processor unit on the control side to a storage unit of the processor unit on the standby side. Stop means for stopping the processor unit on the control side after the holding and the copying of the application data are completed. When the processor unit on the control side stops itself, the processor unit on the standby side operates as a new processor unit on the control side. 226 is an operation restricting means for preventing a processor unit started as a new control side after changing the system program from executing an operation that hinders continuity of control. Data holding means for holding data.

The operation of the system shown in FIGS. 1 and 2 will be described. FIG. 3 is an operation explanatory diagram, and FIG. 4 is a flowchart showing an operation procedure. In the example of FIG.
a is a control side and 10b is a standby side.

(1) Initial State In order to change a system program online, it is necessary for the control computer to be changed that two processor units are operating online and application data is being updated. When this condition is satisfied, the system program is changed.

(2) Stop on Standby Side The system change command of the change program is given to the processor unit on the standby side via the communication bus 3 to stop the processor unit on the standby side. At this time, the update of the application data on the standby side also stops. However, since the processor unit on the control side is operating normally, the control operation is continued without affecting the control target at all.

(3) Loading of a new system program to the standby side The system change command notifies the ROM of the processor unit on the standby side of the start of the change of the system program in the online state, and starts the boot processing program. I do. Then, the new system program is loaded into the standby main storage device in cooperation with the system change command and the activated boot processing program.

(4) Equalization of application data The system change command restarts the boot processing program on the standby side when the loading of the system software is completed. The boot-side boot processing program that has been started is still updated in cooperation with the control-side system program in order to return the standby-side application data that has already been updated to the latest state. Copy the application data on the control side to the standby side. Since the control side is continuing the control operation, the change in the application data generated after the copy is also equalized to the standby side.

(5) Start as Standby Control Side When the update of the application data is completed, the standby side boot processing program notifies the control side system program of the stop. The control-side system program that has received the stop notification self-stops itself.
After confirming that the control side has stopped, the boot processing program on the standby side newly becomes the control side and starts the already changed system program. Here, since the control input / output operation is in a hold state for about 2 seconds after the former control side stops and the former standby side becomes the control side and starts the control operation, the update of the application data is temporarily stopped. The update is restarted after about 2 seconds while the value at the time is kept. This time is such that the influence can be ignored if the control object is stable.

The newly started control side receives the information that the start is after the change of the system program.
Do not execute an operation that hinders control continuity. Operations that hinder control continuity are special items. The special items include, for example, a windup operation and a MAN fallback operation. The windup operation is an operation mode in which control input / output is not performed to adjust control parameters after the start of initialization. The MAN fallback operation is to forcibly change the control state to the manual mode by detecting an abnormality.

(6) Start the original control side The system change command starts the original control side as a new standby side. The new standby side copies the changed system program from the control side by the boot processing program that has been started, and newly operates as the standby side. Thus, the change of the system program in the online state is completed.

In this embodiment, one CPU is provided in one processor unit, and this processor unit has a redundant spare configuration. However, the present invention is not limited to this. Two CPUs are provided in one processor unit. C
A PU may be provided, and a pair-and-spare configuration in which the processor unit is duplicated may be adopted.

[0020]

As described above, according to the present invention, the operation of the processor unit on the control side is continued, the operation of the processor unit on the standby side is stopped, and the storage unit of the stopped processor unit on the standby side is newly stored. By loading the system program, the system program can be changed without affecting the control target. For this reason, restoration of a software failure can be quickly performed. Further, the function can be improved without stopping the entire system. As described above, the present invention can contribute to improvement in reliability, availability, and maintainability in a control computer system.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing one embodiment of the present invention.

FIG. 2 is a diagram showing a specific configuration example of the system of FIG. 1;

FIG. 3 is an operation explanatory diagram of the present invention.

FIG. 4 is a diagram illustrating the operation of the present invention.

[Explanation of symbols]

 Reference Signs List 1 control computer 2 system generation computer 3 communication bus 10a, 10b processor unit 11 CPU 12, 21 storage device 13a, 13b control input / output unit 121 ROM 122 main storage device 22 processor 221 operation control means 222 loading means 223 starting means 224 Copying means 225 Stopping means 226 Operation limiting means 227 Data holding means

Claims (2)

[Claims] 1. A control computer system in which a duplicated processor unit is mounted on a control computer and one of the duplicated processor units operates as a control side and the other as a standby side, wherein each processor unit includes a system program and application data. And a control input / output unit for inputting / outputting control data. When the system program is changed, the operation of the processor unit on the control side is continued and the operation of the processor unit on the standby side is stopped. Operation control means, loading means for loading a new system program into a storage unit of the stopped standby processor unit, and control data even if data from the processor unit is not updated in the control input / output unit of the control processor unit. To keep the Starting means for activating the processor unit on the machine side; copying means for copying application data stored in the storage unit on the processor unit on the control side to the storage unit on the processor unit on the standby side; Stopping means for self-stopping the control-side processor unit after the holding of the control data and the copying of the application data are completed, and when the control-side processor unit self-stops, the standby-side processor unit A control computer system, which is started as a control processor unit. 2. The control computer system according to claim 1, further comprising an operation restricting unit that prevents the processor unit started as the new control side from executing an operation that prevents control continuity.