JPS595302A - Plant distributed control method - Google Patents

Abstract

PURPOSE:To continue smoothly a control even in case of a fault of a controller, by constituting so that each control program of all controllers is contained mutually in one of other controllers, and executing a backup in case when a fault occurs. CONSTITUTION:Dispersion controlling controllers C1-C3 are coupled directly or indirectly through bus lines B1-B3 or a bus line B and a high rank computer HC. Usually, each controller C1-C3 inputs a detecting output from detectors S1-S3, which is assigned to itself, and on the other hand, brings its detecting output suitably to operation processing, etc., and controls operation panels A1- A3. Each control program of all the controllers C1-C3 is contained mutually in one of other controllers, and when a fault occurs, switches SW1-SW3 are switches, and a backup containing a control program of its faulty controller is executed.

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a distributed control method for a plant, and particularly to a method for smoothly backing up control even when some controllers fail, and in particular, eliminating the need to install large hardware in the controllers. The present invention relates to a plant decentralized control method.

In large-scale plant control systems, such as nuclear coupler plant control systems, when the number of control objects increases, it is dangerous to control them with a single plant control controller, so it is distributed by multiple plant control controllers. Control of the controlled object is being carried out in a controlled manner. In such a distributed control system, from the viewpoint of achieving high control reliability, the control system has generally been configured with two Heavy system and 2
It is configured as a redundant system ζ such as out-of-3 or a backup system such as 8:1 backup.

However, if configured as a redundant system, it cannot be denied that the system configuration will be unnecessarily expensive. Also, if configured as a backup system, not only will the connection with the backup controller become complicated, but Since the backup controller is required to take over and execute all the functions of other controllers, it has the disadvantage that the capacity of the memory for storing control programs must be increased as the number of controllers and objects to be controlled increases.

For this reason, control systems are also being considered in which the controller is not configured as a redundant system or a backup system, but in the event that one of the plurality of controllers fails, another controller takes over and executes its function.

Although multiple controllers back up each other, such control systems are not without their problems. This is because, in order to back up each other, each controller needs to have all the control programs executed by the other controllers built in in advance, or it is necessary to import the backup program from the higher-level controller when starting the backup. For this reason, the former has the disadvantage that the memory capacity of the controller needs to be extremely large, and the latter has the disadvantage that it is difficult to smoothly continue control when a failure occurs. be.

An object of the present invention is to eliminate the above-mentioned drawbacks of the prior art, to avoid unnecessarily increasing the memory capacity of each distributed control controller, and to prevent problems even when a plurality of controllers fail. An object of the present invention is to provide a plant decentralized control method that allows smooth continuation of plant control without causing any problems.

In order to achieve the above object, the present invention focuses on the fact that only one backup controller is required to smoothly continue control in the event of a failure of one controller. Each controller is built in one of the other controllers, and when a failure occurs, the control program of the failed controller is backed up by the built-in controller.

Hereinafter, the present invention will be explained in detail with reference to the drawings.

FIG. 1 shows an embodiment of a plant distributed control system embodying the method of the present invention, and for simplicity, the number of controllers is three. , three distributed control controllers C1, C2, C3ti pass line B1. B2. B11 or pass line B1 are directly or indirectly connected via the upper computer HC, and usually each controller CI, C2, C
3 inputs the detection outputs from the detectors 81, 82, and 83 assigned to the self-center, and processes the detection outputs appropriately to operate the operating devices A1. A2. Controls A3.

That is, the controller C1 controls the detector S1, the controller A1,
The controller 02 connects the detector S2 and the operator A2, and the controller C3 connects the detector S3 and the operator A3 to the switches SWI, SW2°SWI, A line B1m B2.
B3, and interface 1 are all managed.

As shown in Fig. 2, the switches SW1 to SW3 maintain the on state as shown in the figure (a) when the controller to which the switch belongs is normal, and switch to the bypass state as shown in the figure (b) when an abnormality occurs in the controller. Become. In the on state, the terminals a, d, l) and C are connected, and the controller having the switch is connected to the pass lines B1-B5, but in the bypass state, the terminals a and C are disconnected, and the terminals d is connected.

FIG. 3 shows the state of the system when controller C2 fails. When controller C2 fails, switch SW2 goes into a bypass state, so controller C3 is connected not only to pass line B3 but also to B2. Therefore, the controller C3 has to control not only the detector 83 and the operating device A3, but also the detector S2 and the operating device A2. Moreover, if the controller C1 fails, although not shown in the figure, the switch S W 1 becomes bypassed, so that the controller c3 detects the detector S11.
The controller A1 is also placed under its own control.

In this way, in this example, the detector and the operating device are
If there is at least one normal controller, the controller will always be under the control of the normal controller.

In addition, in FIGS. 1 and 3, each controller is connected to only one detector and one operating device, but
In reality, it goes without saying that a plurality of various detectors and operating devices are connected to each controller.

FIG. 4 shows an embodiment of one controller, and each controller has the same configuration, and this figure shows controller C3. A central processing unit CPU, a read-only memory ROM, a random access memory RAM, communication control circuits 3, 4, 5, and a switch control circuit 2 are connected to the internal path IB. Among these, the communication control circuit 3 is for communication with the upper controller, the communication control circuit 5 is for managing the detector C3 and the operating device A3, and communication with the controller C2, and the communication control circuit 4 is for communication with the controller C1. It is for use. For transmission control, the communication control circuit 5 is a master station for the detector S3, the operating device A3, and the communication control circuit 4 in the controller C2, and the communication control circuit 4 is a master station for the communication control circuit 4 in the controller C1.
The communication control circuit 3 corresponds to a slave station of the upper controller HC. The switch control circuit 2 is
When the controller C3 is in a normal state, the switch SW3 is kept in the on state, but when the power is down, the controller C3 goes out of control, or is determined to be abnormal by self-diagnosis, the switch SW3 is put into a bypass state.

The read-only memory ROM stores O8, various tables, control subroutines, and own control programs, and the random access memory 1 (OM is used as a work area and an area for storing control programs of other controllers).

FIG. 5 is a flowchart showing the program of the controller C3 of this embodiment. In the controller C2, C2 in the figure becomes C1 and C1 becomes C3, and in the controller C1, C2 in the figure becomes 03 and C1 becomes C2, but the rest is the same. The operation of this embodiment will be explained below with reference to FIG.

When controller C3 starts, it first turns on Sten 7'lO.
In step 11, the control program for the controller C2 is loaded from the controller C2 through the bus B3. This program will be stored in the AM, but will not be executed yet. In step 12, controller C3 executes its own control program to control the plant, and then in step 13 it determines whether backup of controller C2 is necessary. This is not necessary if you are starting from a normal state, so proceed to step 14, and in order to be able to smoothly take over control in the event of a failure of controller C2,
Control information data (for example, integral data for PID control, etc.) is taken in from the controller C2. In step 15,
If controller C2 fails, controller C3
Since there is no response from controller C2, it is determined whether there is a failure or not, and if controller C2 is normal,
The control information data from the controller C2 is stored in the random access memory RAM in step 16, and the normality of the controller 9C3 itself is checked in step 17.
If it is normal, the process returns to step 12 and the control for the detector S3 and the operating device A3 is repeated. If an abnormality is found in step 17, the control is stopped by setting the own switch SWa in a bypass state in step 18. When the controller C3 itself is normal and an abnormality in the controller C2 is detected in step 15, the bypass switch 8W2 is switched to the bypass state by a program corresponding to FIG. 5 in the controller C2.

Therefore, in step 19, the controller C3 makes it possible to execute the control program for the controller C2 inputted in step 11, and in step 20, the controller C3
Import the control program of 1.

This is because the switch SW2 is in the bypass state, so the pass line B2. B3 is directly connected as shown in FIG. 3, and is taken in through this path. Then step 17.1
2 and proceed to step 13, controller C
2 abnormality was detected in step 15, the need for backup of other controllers is set,
Proceed from step 13 to step 21. This step 2
In 1, run the control program of controller ()C2,
From now on, steps 14, 15, and 16 are performed by controller C1.
As long as the controller C1 is normal, steps 12.13.21, 1 are performed.
Processes 4, 15, 16, and 17 are repeated. That is, this is the detector 83 and 82 by the controller C3, and the controller A.
3. This is a repetition of the control in A2. Note that during this repetition, C1 in step 20 becomes C3, that is, itself. In reality, if the controller C1 fails in this state, it is pointless to obtain the control program from itself, so the controller only executes the controllers C1 and C2 and its own control program.

The above operation is the same for other controllers, and ideally by this plant distributed control method, plant control can be continued until there is only one normal controller. However, in typical systems, faulty controllers are typically repaired as quickly as possible. Therefore, according to this method, each controller has control programs for two or three units, that is, its own program and one for backup.
゜If you have enough memory capacity to store two machines, extremely reliable distributed control can be achieved.

Note that in this embodiment, there are three controllers, but there are four controllers.
The same method can be used for more controllers, and the greater the number of controllers, the greater the implementation effect.

As described above, according to the present invention, the controller 2.
By providing a memory capacity that can store programs for three controllers in the control program area of each controller, plant control can continue smoothly even if multiple controllers fail without causing any problems. There is.

[Brief explanation of the drawing]

Fig. 1 is a block diagram of a control system showing an embodiment of the present invention, Figs. 2 (a) and (b) are diagrams explaining the operation of the switch,
FIG. 3 is an explanatory diagram of the system configuration at the time of controller failure, FIG. 4 is a diagram showing an embodiment of the controller, and FIG. 5 is a flowchart explaining the distributed control method of the present invention. 01-C3... Controller, B1-B3... Pass line, SW1-SW3... Changeover switch, HC...
・L position controller, 81-S3...detector, AI-
A...Controller, 1...Interface, 2...
Switch control circuit, 3, 4.5... Communication control circuit, C
PU...processing unit, ROM...read-only memory,
RAM...Archive Z layer

Claims (1)

[Claims] 1. In a plant distributed control method for a system configured such that a plurality of controllers share and control plant control targets, each controller is connected via a changeover switch so as to be mutually accessible via a path line,
Each controller has two functions: execution of a control program for its own controller by two people, and importing a control program for the other controller 2 via the above-mentioned pass line and changeover switch, and backing up control information when that program is running. In addition, when an abnormality occurs in one of the controllers, the backup controller that has taken in the control program and control information for the abnormal controller becomes the control target of both the own controller and the abnormal controller. is controlled via the changeover switch and the pass line by executing both control programs, and the control program of another controller and its control information, which the abnormal controller has been importing, is obtained via the pass line. 1. A plant distributed control method, characterized in that said controller is also prepared for backup of said another controller.