JP6560489B2 - Control controller and control method thereof - Google Patents

Description

  The present invention relates to a control controller that performs automatic control of plant equipment and the like.

As a control controller for automatic control, there is a system in which a CPU (Central Processing Unit) module and a plurality of remote input / output (IO) modules are connected by a transmission cable. The configuration is such that the CPU module executes a control program for automatic control and outputs digital data DO (Digital Output data), and the remote IO module converts the digital data DO received from the CPU module into a plant output signal. Output to the operation terminal of the equipment.
This remote IO control controller has the advantage that it can realize control of a plurality of distributed plant facilities in a space-saving and low-cost manner.

For example, the above-mentioned controller is applied to a water and sewage plant composed of a plurality of facilities, and the plant is controlled. Each facility of the water and sewage plant is composed of a plurality of devices, and each device has an operation terminal. By outputting a plant output signal from the outside to this operation terminal, it is possible to operate or stop the equipment. The plant output signal is appropriately output from the controller or the manual operation device to the operation terminal, and the operation of the device alone and the operation of the entire plant are realized.
A malfunction or stoppage of a control controller of a water and sewage plant may cause water supply interruption or urban flooding and threaten human lives and property. For this reason, the controller is required to operate stably for 24 hours.

Thus, high reliability is required for a controller for a water and sewage plant.
If the controller detects an abnormality, it can be stopped urgently to prevent malfunction of the plant, or it can be operated while maintaining the plant function in the state before the abnormality is detected. Therefore, it is necessary to switch to manual operation or operation.

In particular, when the abnormality of the controller is detected as the most dangerous CPU module abnormality, it is necessary to urgently stop the plant by avoiding the risk of erroneous output of the digital data DO due to the CPU malfunction.
In addition, because water and sewage plants are equipped with noise source devices such as high-voltage electrical equipment, induction motors, and inverters, when applying a remote IO module, noise to the transmission cable connecting the CPU module and the remote IO module There is a possibility that a temporary transmission error may occur due to superposition.

Conventionally, in view of such circumstances, there has been proposed a technique for controlling a power supply of an external load when an abnormality of a controller is detected (see, for example, Patent Document 1).
According to the technique disclosed in Patent Document 1, an abnormality is detected by the pulse output output by the main program and an external electric circuit timer composed of a relay and a timer, and when an abnormality is detected, the power supply to the external load is cut off or turned on. The fail-safe function is realized.

  Further, in Patent Document 2, an abnormality check output terminal of the MPU 11 is provided so that the output state of the output terminal of the IO unit at the time of abnormality check is a state in which the connected IO device is not activated. Thus, an IO unit capable of detecting the presence / absence of a failure / abnormality in advance is disclosed.

JP 9-185403 A JP 2008-310389 A

According to the technique disclosed in Patent Document 1 above, the pulse output is monitored by a combination of an on-delay timer and an off-delay timer. It takes time. Therefore, within the abnormality detection waiting time, there is a problem that an erroneous output to the plant due to a CPU malfunction cannot be prevented.
Further, according to Patent Document 1, any abnormality in the CPU module, remote IO module, main program, transmission, and external electric circuit is detected as the same abnormality, so that the CPU abnormality is particularly dangerous. There is a problem in that it is difficult to detect digital data DO at the time of detection by detecting a high-frequency abnormality factor.
In addition, there is a problem that a transmission abnormality necessary for a control controller composed of a CPU module and a remote IO module cannot be detected, and an abnormal time control operation cannot be selected and set when a transmission abnormality is detected.

According to the technique disclosed in Patent Document 2 described above, it is possible to detect the presence or absence of an IO unit failure or abnormality in advance, but the failure detection during actual operation is not considered, and the PLC There is a problem that the failure of the CPU unit and the master unit is not taken into consideration.
As described above, the techniques disclosed in Patent Documents 1 and 2 cannot achieve the reliability required for a water and sewage control controller.

The present invention has been made in view of such circumstances, the controller including a CPU module and a remote IO module, the control operation of the abnormal time reliably by CPU abnormally depending, and selectively performs, A controller that can achieve high reliability is provided.

In order to solve the above-mentioned problem, a control controller for controlling the plant equipment of the present invention has an abnormal state detection unit for detecting an abnormal operation of the module, and has a plurality of plant equipment in the plant at a predetermined control cycle. A CPU module that performs program control, and a plurality of remote IO modules that are daisy chain connected to the CPU module via a serial transmission line, convert digital data transmitted from the CPU module at each control cycle, and output the digital data to the equipment The remote IO module further includes a transmission abnormality control unit that detects a transmission abnormality of the serial transmission path and changes digital data, and the transmission abnormality control unit is configured to detect a transmission abnormality. For each of a plurality of equipment connected, a predetermined value set in advance via the serial transmission path The CPU module changes the digital data based on the update rule, and the CPU module detects the abnormal operation when the abnormal state detection unit monitors the processing cycle of the program control and the process exceeds a predetermined monitoring time. The CPU error is notified to the remote IO module by a signal cable for daisy chain connecting the CPU module different from the serial transmission path and the remote IO module, and the remote IO module is notified of the CPU abnormality. At times , asynchronously with the output of the digital data, the output is insulated in addition to the control by the digital data so that all of the equipment is stopped.

Further, the control method of the control controller having the CPU module of the present invention and the remote IO module for controlling at least one equipment of the plant and controlling the plurality of equipment of the plant is the plurality of equipment of the plant. By means of a serial transmission path that daisy chain connects the CPU module and the remote IO module for program control, from the CPU module to the remote IO module at control information for program control of the equipment. transmitting a certain digital data DO, wherein the CPU module monitors the processing cycle of the program control, as the processing detects an abnormal operation when exceeded a predetermined monitoring time, separate from the serial transmission line the and of the CPU module remote A step of the IO module CPU state daisy chained signal cable for outputting a signal indicating an abnormal state, set corresponding to the digital data DO which has been notified of the respective operation terminals from the CPU module of the plurality of equipment The remote IO module monitors the serial transmission path connecting the CPU module and the remote IO module at a predetermined control cycle, and detects digital data DO notified from the CPU module when a transmission abnormality is detected. A step of changing according to a predetermined change rule set in advance via the serial transmission path, and when the CPU status signal indicates an abnormal state, the remote IO module is asynchronous with the output of the digital data D0, All the operation terminals apart from the digital data DO Set in the insulating state as the equipment is stopped, the other time, and to have, and outputting the digital data DO to the operating terminal.

  According to the present invention, the reliability of the control controller can be improved.

It is a block diagram of the control controller of a water and sewage plant. It is a figure which shows the structural example of a CPU module. It is a time chart explaining abnormality detection processing of a control program It is a figure which shows the structural example of a remote IO module and equipment. It is a figure which shows the structure of a CPU abnormality control part. It is a figure which shows the structure of IO output part of a remote IO module. It is a figure which shows an example of the time chart of a CPU abnormality control part. It is a figure which shows the other structure of a remote IO module. It is a figure which shows an example of the time chart of the digital data DO output from a remote IO transmission part. It is a flowchart in the case of program-processing the operation | movement of a remote IO module. It is a flowchart of CPU abnormality processing performed asynchronously. It is a figure which shows an example of a water transport plant.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Embodiment 1
In this embodiment, a water and sewage plant such as a water purification plant that takes raw water from a dam or a river and performs chemical precipitation, sand filtration, and chlorine injection to produce tap water will be described as an example.

  Water and sewage plants such as water purification plants are composed of raw water pump equipment, high-pressure power receiving equipment, emergency generator equipment, chemical injection equipment, sedimentation basin equipment, filter basin equipment, chlorine injection equipment, water pump equipment, drainage equipment, etc. The Each of these facilities includes control devices such as pumps, motors, valves, circuit breakers, and engines, and detection devices such as water level meters, flow meters, and water quality sensors.

Some of the above control devices include a state contact for outputting the operation state of the device to the outside. Here, the operation state of the device includes an open / close state such as full open, full close, and full open of a valve, on / off of a circuit breaker, and a failure state of the device during operation or stop of the pump.
The electrical specification of the state contact is, for example, a binary output in which the pump is electrically conductive when the pump is in operation and is insulative when the pump is stopped.
Further, the detection device includes an analog output terminal that converts numerical information of sensor output such as current, voltage, flow rate, water level, water pressure, and opening degree into an analog signal of voltage or current and outputs the analog signal.

In addition, some of the above control devices include an operation terminal for operating the operation of the device from the outside. By making the operation terminal electrically conductive or insulated, the operation stop of the pump and the motor, the opening and closing of the valve and the gate, the ON / OFF of the circuit breaker and the capacitor are controlled. For example, the pump operates when the operation terminal of the pump is electrically connected from the outside, and the pump stops when the operation terminal is insulated. The operation terminal may be an analog input terminal for inputting an analog signal from the outside. In this case, the opening degree, the rotation speed, etc. of the control device are operated according to the signal of the analog input terminal.
The above detector may have an analog input terminal.

FIG. 1 is a configuration diagram of a control controller of a water and sewage plant such as a water purification plant equipped with the control device.
The controller 1 includes a CPU (Central Processing Unit) module 2 and a plurality of remote IO (Remote Input / Output) modules 3a, 3b, 3c (hereinafter collectively referred to as a remote IO module 3).

The CPU module 2 and the plurality of remote IO modules 3 are daisy chain connected by a multi-drop serial transmission path 5 such as RS-485. Then, the remote IO module 3 is accessed via the serial transmission path 5 by a sequence program that operates on the CPU module 2, and a plurality of equipment 4a, 4b, 4c,... Are collectively controlled).
In the system configuration diagram of FIG. 1, a configuration having a plurality of remote IO modules 3 is shown, but a configuration of one CPU module 2 and one remote IO module 3 may be used.

  In the following description, digital data transmitted between the CPU module 2 and the remote IO module 3 via the serial transmission path 5 is digital data DI (DI: Digital Input data) for input and output for 1-bit configuration. Digital data DO (DO: Digital Output data), analog input data AI (AI: Analog Input data), analog output data AO (AO: Analog Output data), pulse input data PI (PI: Pulse) Input data).

In the remote IO module 3, the state contacts, operation terminals, analog input terminals, and analog output terminals of the plurality of equipment devices 4 are respectively connected to the device connection cables 7a, 7b, 7c,... 7i (hereinafter collectively referred to as the device connection cable 7). ) Is connected through. The electrical specifications of the device connection cable 7 have voltage outputs such as AC100V, AC200V, DC24V, DC48V, etc., and are in a conductive or insulated state. Or it is analog signals, such as 4-20mA and 1-5V.
Via the device connection cable 7, the state contacts, operation terminals, analog input terminals, and analog output terminals of the equipment device 4 are accessed from the remote IO module 3, and the CPU module 2 controls the equipment device 4 by the remote IO module 3. To do.

  More specifically, the state of the state contact of the facility device 4 is input to the remote IO module 3 as a signal from the facility device via the device connection cable 7. The input state of the state contact of the equipment device 4 is converted into digital data DI transmitted from the remote IO module 3 to the CPU module 2. Specifically, DI is converted to “1” if the state contact of the equipment device 4 is in a conductive state, and DI is converted to “0” if it is in an insulated state. The converted digital data DI of the state contacts of the equipment 4 is transmitted from the remote IO module 3 to the CPU module 2. If the equipment device 4 outputs a voltage or current level, the state of the analog output terminal of the equipment device 4 is AD converted to analog input data AI, which is transmitted from the remote IO module 3 to the CPU module 2. The

When the digital data DO is transmitted from the CPU module 2, the remote IO module 3 drives the device connection cable 7 to a conductive state or an insulated state and controls the operation terminal of the equipment device 4. Specifically, the device connection cable 7 is driven to a conductive state if DO is “1”, and is driven to an insulated state if DO is “0”.
Further, the remote IO module 3 performs DA conversion on the analog output data AO to generate an analog signal and outputs the analog signal to the analog input terminal of the equipment device 4.

Although three equipment devices 4 are connected in FIG. 1, 8 to 64 equipment devices 4 can be connected to one remote IO module 3. A plurality of I / O modules 3 are connected to the CPU module 2. In general, the total number of status contacts, operation terminals, analog input terminals, and analog output terminals that are input and output by one controller is several tens to several thousand.
The device connection cable 7 is laid for each of the state contacts, operation terminals, analog input terminals, and analog output terminals, and has several tens to thousands. In particular, in a large-scale system, it is difficult to lay the device connection cable 7. For this reason, application of the remote IO module 3 facilitates the laying of the device connection cable 7 by installing the remote IO module 3 in the vicinity of the equipment device 4. Is required.
Further, the remote IO module 3 needs to cope with the abnormal operation of the CPU module 2.
The controller 1 of this embodiment deals with transmission errors and abnormal CPU operations as follows.

  The CPU module 2 executes a control program based on the digital data DI and the analog input data AI, and outputs digital data DO and analog output data AO as execution results. At this time, the CPU module 2 of the present embodiment monitors the status of hardware and programs, detects an abnormal operation, and outputs the presence or absence of the abnormality to the CPU status signal 6.

Further, the remote IO module 3 has error detection means for the serial transmission path 5 such as a parity error. When a transmission error is detected, the DO of each facility device 4 is set to “0” (insulated state) Alternatively, the state before error detection is held.
Further, when the CPU status signal 6 indicates that the CPU is abnormal, the remote IO module 3 drives the operation terminals of all the equipment devices 4 in an insulated state regardless of the DO status.

Hereinafter, a configuration for processing a transmission error and an abnormal operation of the CPU will be described in detail.
FIG. 2 is a diagram illustrating a configuration example of the CPU module 2. The CPU module 2 includes a CPU 21, a memory 22, a CPU transmission unit 23, an abnormal state detection unit 25, and an abnormal state output unit 26, which are connected to each other via a CPU system bus 24. The memory 22 is a RAM (Random Access Memory) or the like, and includes a control program 221 and a register 222.

  The CPU transmission unit 23 executes serial communication with the remote IO module 3 via the transmission cable 5 at a predetermined cycle corresponding to the processing of the control program 221 to transmit / receive digital data DI, digital data DO, and the like. To do. Further, the CPU transmission unit 23 sends and receives digital data DI and digital data DO to and from the register 222 via the system bus 24, thereby matching the digital data in the remote IO module 3 and the register 222 (refreshing). Called processing).

The control program 221 is a sequence control or loop control program for the equipment 4, and the register 222 has digital data DI, digital data DO, analog input data AI, analog output data AO, and initial data and operations of the control program. Data etc. are stored.
The control program 221 is periodically executed by the CPU 21, and the contents of the state contacts of the equipment 4 are converted into digital data DI by the remote IO module 3 and then stored in the register 222 via the CPU transmission unit 23. Thus, the control program 221 is input.
The control program 221 receives the digital data DI of the register 222, executes a program operation such as a logical operation or a numerical operation, and outputs the digital data DO as an execution result. The digital data DO output to the register 222 by the control program 221 is transmitted to the remote IO module 3 via the CPU transmission unit 23, and the operation terminal of the equipment device 4 is set at a predetermined cycle.

FIG. 3 is a time chart for explaining the abnormality detection process of the control program 221.
The control program 221 repeatedly executes the process at a control cycle of, for example, 50 ms, 100 ms, or 200 ms.
This process includes a refresh process of the IO module that makes the digital data in the remote IO module 3 and the register 222 coincident, and a program operation. The result of the program operation stored in the register 222 is transmitted to the remote IO module 3 in the refresh process of the IO module in the next cycle.

When an abnormal operation of the CPU 21 or the memory 22 or a program abnormality of the control program 221 occurs, the program calculation may not end in a predetermined time.
The abnormal state detection unit 25 monitors the processing cycle of the control program 221 and determines that the CPU is abnormal if the processing cycle of the control program 221 exceeds a predetermined monitoring time.

  More specifically, a monitoring timer that overflows with a predetermined monitoring time is provided in the abnormal state detection unit 25, and the timer is initialized and started at the head of the control program 221. When the control program 221 is operating normally, the monitoring timer does not overflow. However, if the control program 221 delays processing and an overflow of the monitoring timer occurs, it is determined as an abnormal operation of the CPU.

  Further, as a configuration in which the IO module refresh process and the control program are executed independently, the IO module refresh process and the control program process cycle are monitored, and if any of the process cycles exceeds a predetermined monitoring time, You may make it determine as operation abnormality of CPU. A plurality of control programs may be provided.

  Further, the abnormal state detection unit 25 in FIG. 2 detects hardware abnormalities such as ROM sum errors and memory bit errors, and software abnormalities such as OS abnormalities and control program abnormalities by exception processing of illegal instruction execution. Also good.

The abnormal state output unit 26 notifies the plurality of remote IO modules 3 of the abnormal state of the CPU module 2 detected by the abnormal state detection unit 25 by the CPU state signal 6. Therefore, a differential serial interface such as RS-485 capable of multidrop connection is used for the CPU status signal 6, as in the case of the serial transmission path 5.
The serial transmission path 5 performs data transfer at a predetermined interval, but the CPU status signal 6 outputs an abnormal state of the CPU module 2 as soon as an abnormality is detected.

As described above, by providing the CPU status signal 6 separately from the serial transmission path 5, the CPU abnormal state communication can be performed asynchronously regardless of the operation of the CPU transmission unit 23 of the CPU module 2. Notification of abnormalities can be made quickly.
Further, since the CPU status signal 6 only needs to be able to notify the CPU abnormality, the communication capacity may be small, and the communication rate can be made smaller than that of the serial transmission path 5. Thereby, the data reliability of the transmission of the CPU status signal 6 can be improved.

Further, the abnormal state output unit 26 includes a CPU state contact for converting the state data detected by the abnormal state detection unit 25 into a signal for driving the CPU state signal 6 and outputting the signal to the outside. Good. At this time, the CPU state contact is constituted by, for example, a semiconductor relay or an electromagnetic relay. If the status data is normal to the CPU, the CPU status contact may be in a conductive state, and if the status data is abnormal, the CPU status contact may be in an insulated state.
In this case, when the power supply to the CPU module 2 is stopped, the CPU state contact transitions to the insulated state, so that the power supply stop is also output as a CPU abnormality.

More specifically, for example, it has a voltage of AC100V, AC200V, DC24V, DC48V, etc., has a contact specification of conduction state or insulation state, and the CPU status signal 6 is, for example, a two-core cable, the abnormal state of the CPU. The presence or absence can be reliably output from the CPU module 2 to the remote IO module 3 without being affected by external noise.
Alternatively, a current source of 4 to 20 mA may be provided, the presence / absence state of the current may be a contact specification, and the current may be present when the CPU is normal.

FIG. 4 is a diagram illustrating a configuration example of the remote IO module 3 and the equipment 4.
The remote IO module 3 includes a remote IO transmission unit 31, an IO input unit 36, an IO output unit 34, and a CPU abnormality control unit 35, which are connected to each other via a system bus 33. The IO input unit 36 is connected to the state contact 41 of the control device 42 of the equipment device 4 by the device connection input cable 7-2, and the IO output means 34 is connected to the operation terminal 40 of the control device 42 of the equipment device 4. It is connected by a device connection output cable 7-1.

  Here, the IO input unit 36, the IO output unit 34, and the CPU abnormality control unit 35 surrounded by a broken line in FIG. 4 indicate the configuration of one bit of digital data, and the remote IO module 3 has 16 bits. If it corresponds to the digital data DI / DO, the configuration includes 16 IO input units 36, an IO output unit 34, and a CPU abnormality control unit 35.

The remote IO transmission unit 31 performs serial transmission via the CPU module 2 and the serial transmission path 5, and transmits and receives digital data DI and DO. Here, the serially transmitted digital data is composed of, for example, a plurality of words in which 16 DIs are 1 word or 16 DOs are 1 word.
The remote IO transmission unit 31 receives digital data DI corresponding to the state of the state contact 41 from the IO input unit 36 via the system bus 33, converts the digital data DI into word digital data, and transmits the digital data to the CPU module 2.
In addition, the remote IO transmission unit 31 extracts the digital data DO transmitted from the CPU module 2 and outputs the digital data DO to the IO output unit 34 via the CPU abnormality control unit 35 connected to the system bus 33. To do.

A CPU status signal 6 is connected to the CPU abnormality control unit 35 to notify the normal or abnormal state of the CPU module 2. The CPU abnormality control unit 35 calculates the IO output of the remote IO module 3 between the normal or abnormal state of the CPU module 2 and the digital data DO input from the remote IO transmission unit 31. Is output to the IO output unit 34.
Specifically, when it is notified that the CPU module 2 is in a normal state, the IO output unit 34 outputs a state corresponding to the digital data DO, and the CPU module 2 is in an abnormal state. Is notified, the IO output unit 34 is controlled to output the insulation state.

  The IO output unit 34 is connected to the operation terminal 40 of the facility device 4 via the device connection output cable 7-1, and is connected to the operation terminal 40 of the facility device 4 according to the setting of the CPU abnormality control unit 35. Notify the insulation status. Thereby, the equipment 4 is controlled.

  The IO input unit 36 is connected to the state contact 41 of the equipment device 4 via the device connection input cable 7-2, and acquires the conduction state or the insulation state of the state contact 41. When the state contact 41 is in a conductive state, the digital data DI is set to “1”, and when the state contact 41 is in an insulated state, the digital data DI is set to “0”. The set digital data DI is notified to the CPU module 2 via the remote IO transmission unit 31.

FIG. 5 is a diagram illustrating a configuration of the CPU abnormality control unit 35.
The CPU abnormality control unit 35 includes a first input circuit 351, a second input circuit 352, and a logical operation circuit 353.
The first input circuit 351 is connected to the abnormal state output unit 26 of the CPU module 2 via the CPU state signal 6 and converts the signal level of the CPU state signal 6 to a TTL (Transistor Transistor Logic) level. For example, when the CPU status signal 6 indicates an abnormal state of the CPU module 2, it is converted to a low level, and when it indicates a normal state of the CPU module 2, it is converted to a high level.

The second input circuit 352 is connected to the system bus 33 and converts the digital data DO received by the remote IO transmission unit 31 to a TTL level. For example, when the digital data DO is “0”, it is converted to a low level, and when the digital data DO is “1”, it is converted to a high level.
The logic operation circuit 353 is a logic circuit configured by TTL, for example, and performs a logic operation of signals from the first input circuit 351 and the second input circuit 352 and outputs a control output signal. The control output signal is high level when logic is established, and low level when logic is not established.

The logical operation circuit 353 of the embodiment includes a logical product circuit, and outputs a control output signal as follows.
When the CPU status signal 6 indicates the normal state of the CPU module 2 and the digital data DO is “1”, the output of the first input circuit 351 is at the high level and the output of the second input circuit 352 is also at the high level. As a result of the logical product by the logical operation circuit 353, a logic high level is output as a control output signal.
When the CPU status signal 6 indicates the normal state of the CPU module 2 and the digital data DO is “0”, the output of the first input circuit 351 is high level and the output of the second input circuit 352 is low level. As a result of the logical product by the logical operation circuit 353, the low level where the logic is not established is output as the control output signal.

  When the CPU status signal 6 indicates an abnormal state of the CPU module 2, even if the digital data DO is “1” or “0”, the logical operation result of the logical operation circuit 353 indicates that the logic is not established. Low level is output as a control output signal.

FIG. 6 is a diagram illustrating a configuration of the IO output unit 34 of the remote IO module 3.
The IO output unit 34 includes a relay circuit 341 and an output terminal 342.
The relay circuit 341 includes, for example, a semiconductor relay or an electromagnetic relay, and turns on / off the output side circuit according to the control output signal of the CPU abnormality control unit 35. For example, if the control output signal is at a high level, the relay is turned on. If the control output signal is at a low level, the relay is turned off.
The output terminal 342 is connected to the operation terminal 40 of the equipment device 4 by the device connection output cable 7-1, and the operation terminal 40 is made conductive or insulated by the relay circuit 341.

FIG. 7 is a diagram showing an example of a time chart of the CPU abnormality control unit 35, and shows a relationship among the CPU status signal, the digital data DO, and the control output signal.
When the CPU status signal 6 indicates a normal state, if the digital data DO is “1”, the control output signal is at a high level, and if the digital data DO is “0”, the control output signal is at a low level. Output. As a result, a control output signal corresponding to the value of the digital data DO is output, and the operation terminal 40 of the equipment device 4 is controlled to a conductive state or an insulated state.
On the other hand, when the CPU state signal indicates an abnormal state, the control output signal outputs a low level regardless of whether the digital data DO is “1” or “0”. Therefore, when the CPU state signal indicates an abnormal state, the operation terminal 40 of the equipment 4 is controlled to be in an insulated state.

  In the above description, the CPU abnormality control unit 35 has been described as having a configuration corresponding to one point of digital data DO. However, when the remote IO module 3 has a configuration corresponding to 16 points of digital data DO, FIG. Sixteen 2-input circuits 352 and sixteen AND circuits 353 are provided, and sixteen control output signals are output from the AND circuit 353. When the abnormal state of the CPU module 2 is notified by the CPU state signal 6, all of the 16 IO output units 34 control the operation terminals 40 of the connected control devices 4 to the insulated state.

  When the controller 1 has a plurality of remote IO modules 3 as shown in FIG. 1, since the CPU status signal 6 is daisy chain connected to the plurality of remote IO modules 3, the abnormal state of the CPU module 2 is detected. Is notified to all the remote IO modules 3. In each remote IO module 3, the above processing is performed to control the operation terminal 40 of the control device 4 to be connected to an insulated state. Thereby, it is possible to stop all equipment to be controlled by the controller 1.

<< Embodiment 2 >>
FIG. 8 is a diagram showing another configuration of the remote IO module 3.
The remote IO module 3 includes a remote IO transmission unit 31, a transmission abnormality control unit 32, a plurality of IO input units 36 and IO output units 34 provided for each connected equipment 4 and a CPU abnormality control unit 35. The buses 33 are connected to each other. Further, the IO input unit 36 is connected to the state contact 41 of the equipment 4 by the equipment connection input cable 7-2, and the IO output unit 34 is connected to the operation terminal 40 of the equipment 4 and the equipment connection output cable 7-1. It is connected.
4 is different from the remote IO module 3 shown in FIG. 4 in that the remote IO module 3 according to the present embodiment includes the transmission abnormality control unit 32, and the difference will be mainly described below.

The transmission abnormality control unit 32 monitors the transmission state of the serial transmission path 5 connecting the remote IO module 3 and the CPU module 2 for each control cycle via the remote IO transmission unit 31 and detects a transmission abnormality. The remote IO transmission unit 31 is controlled to change the digital data DO according to a preset change rule.
Here, the transmission abnormality detected by the transmission abnormality control unit 32 is an error such as a disconnection such as a cable disconnection, a time-out detection in which transmission / reception is not completed within a predetermined time, a CRC error or a parity error of digital data to be transmitted. Determine by detection.

  For example, a change rule for changing the digital data DO when the transmission abnormality control unit 32 detects a transmission abnormality for each control period rewrites DO to “0” (zero clear), and maintains the digital data DO before the abnormality is detected. (Hold).

  This change rule can be set for each bit of the digital data DO, that is, for each equipment 4 to be controlled. Therefore, in the remote IO module to which the equipment 4 having a plurality of operation terminals is connected, a change rule is set by the CPU module 2 for each digital data DO.

The digital data DO changed in the remote IO transmission unit 31 when the transmission is abnormal is transmitted to the CPU abnormality control unit 35.
As described above, the CPU abnormality control unit 35 changes the digital data DO in accordance with the state of the CPU state signal 6 and outputs a control output signal to the IO output unit 34. This control output signal is converted into a conduction state or an insulation state by the IO output unit 34 and notified to the operation terminal 40 of the equipment device 4.

FIG. 9 is a diagram illustrating an example of a time chart of the digital data DO output from the remote IO transmission unit 31. The relationship between the digital data DO input from the CPU module 2, the presence / absence of transmission abnormality, and the output rule of the CPU abnormality control unit 35 is shown for each change rule of digital data at the time of transmission abnormality.
When the transmission abnormality of the transmission cable 5 is not detected by the transmission abnormality control unit 32, the digital data DO is changed from the remote IO transmission unit 31 to the CPU abnormality control unit 35 regardless of the setting of the change rule of the digital data DO. If there is no CPU abnormality, it is output as it is.

On the other hand, when a transmission abnormality is detected, the digital data DO output to the CPU abnormality control unit 35 differs depending on the setting of the change rule for the digital data DO. If the rule is a hold setting, the digital data DO is changed to a value before detection of transmission abnormality ("1" in FIG. 9) and output. If the rule is zero clear, the digital data DO is changed to “0” and output. If there is no CPU abnormality, the changed digital data DO is output.
In this way, by providing a change rule for digital data DO for each equipment device 4, it is possible to change the response method when an error occurs according to the importance of the equipment device 4, thereby improving the reliability of the system. Can be planned.

FIG. 10 is a flowchart when the operation of the remote IO module 3 is programmed. The flow of FIG. 10 operates in each of the plurality of remote IO modules 3.
First, it is determined whether the digital data DO of its own remote IO module 3 has been received (S901). If the digital data DO addressed to the own remote IO module 3 is not transmitted from the CPU module 2, it waits for reception (No in S901).

When the digital data DO addressed to itself is received (Yes in S901), the presence / absence of transmission abnormality at the time of reception is determined (S902). Specifically, the transmission abnormality is determined by parity check, CRC code, sum check, and the like.
If there is no abnormality (No in S902), the received DO is temporarily stored for transmission abnormality processing to be described later (S909), assuming that the digital data DO has been normally transmitted, and the process proceeds to S906.

If there is a transmission abnormality (Yes in S902), the digital data DO is changed as follows.
First, the type of the set correction rule is determined (S903), and if it is “zero clear” (“zero clear” in S903), the digital data DO is rewritten to zero (S904), and the process proceeds to S906.
If “HOLD” is determined in S903 (“HOLD” in S903), the digital data DO is rewritten to the DO value of normal transmission immediately before being temporarily stored in S909 (S905). That is, after rewriting to the value before detecting the abnormality, the process proceeds to S906.

In step S <b> 906, it is determined whether a CPU abnormality notification is detected from the CPU module 2. If a CPU abnormality is detected (Yes in S906), the digital data DO is rewritten to zero unconditionally (S907), and the process proceeds to S908.
If the CPU abnormality notification is not detected in S906 (No in S906), the process proceeds to S908.
In S908, the digital data D0 is set in the IO output unit 34, and the conduction state or the insulation state is output according to the value of the digital data DO.

According to the above flow, the occurrence of transmission abnormality in the serial transmission path 5 and the abnormal operation of the CPU module 2 are detected and the digital data DO is changed, so that abnormal control of the controller 1 can be prevented.
Further, in order to quickly take measures against the abnormality of the CPU module 2, the processing when the abnormality of the CPU module occurs can be performed asynchronously with the processing flow of FIG.

FIG. 11 is a flowchart of CPU abnormality processing performed asynchronously.
The processing in FIG. 11 is preferably started by the reception data interrupt of the CPU status signal 6 and the interrupt priority level is preferably as high as possible.
The processing contents of S906, S907, and S908 in FIG. 11 are the same as those in FIG.

<< Embodiment 3 >>
Next, a specific example of the change rule of the digital data DO processed by the transmission abnormality control unit 32 will be described with reference to FIG.
FIG. 12 is a diagram illustrating an example of a water transport plant that pumps the stored water of the pump well 8 and controls the target flow rate to flow out from the pipe 9 as effluent water.
The water transportation plant includes a pump well 8, a pipe 9, a fixed speed pump 42a, an electric valve 42b for adjusting a flow rate, and a flow meter 42c. The effluent discharged by the fixed speed pump 42a is measured by the flow meter 42c and controlled by the motor operated valve 42b so as to have a constant flow rate.

In this water transport plant, the equipment 4a including the fixed speed pump 42a, the equipment 4d including the electric valve 42b, and the equipment 4g including the flow meter 42c are connected to the equipment connection cables 7a, 7d, and 7e, respectively. 7g, the remote IO modules 3a, 3b, 3c are connected, and the CPU module 2 controls the flow rate. The remote IO modules 3a, 3b, and 3c are daisy chain connected to the CPU module 2 by the serial transmission path 5 and the CPU status signal 6.
The function of the equipment 4a, 4d, 4g will be described next.

  The fixed speed pump 42a of the equipment 4a has a specification with a constant rotational speed, and discharges a constant flow rate during operation, and the discharge flow rate when stopped is zero. The equipment 4a includes an operation terminal 40a, and continues the pump operation by bringing the operation terminal 40a into an electrically conductive state, and stops the pump operation when in an insulated state.

The electric valve 42b of the equipment 4d controls the opening and closing operations of the valve by the normal rotation and reverse rotation of the motor, and controls the discharge flow rate from the fixed speed pump pump 42a. The valve opening operates in a range of 0 to 100%, for example, 0% fully closed and 100% fully opened. The valve opening is set by controlling the operation time of the valve opening and closing operations.
Specifically, in the opening operation and the closing operation, for example, when the valve opening rate is 5% per second, when the opening operation is held for 20 seconds in the fully closed state, the opening operation is stopped and the opening operation is stopped. Conversely, if the closing operation is held for 20 seconds in the fully open state, the fully closing state is reached, and the closing operation is stopped.
The equipment 4d includes an operation terminal 40b (opening operation) and an operation terminal 40c (closing operation), and the operation terminals 40b and 40c are kept in an electrically conductive state to continue the opening operation or the closing operation, thereby being in an insulated state. When set to, the opening or closing operation is stopped.
The valve opening degree of the electric valve 42b of the equipment device 4d is controlled to the target opening degree by adjusting the time during which the operation terminal 40b or the operation terminal 40c is in the conductive state.

The flow meter 42c of the equipment 4g measures the outflow rate of the outflow water.
The analog output terminal 43 of the equipment 4g converts the measured flow value into a current signal of 4 to 20 mA and outputs it.

In the CPU module 2, the outflow rate of the analog output terminal 43 is acquired as analog input data AI via the remote IO module 3c, and the fixed speed pump 42a is operated and stopped so that the analog input data AI becomes the target flow rate. A control program for controlling the opening and closing operations of the electric valve 42b is executed.
In the fixed speed pump 42a, an operation instruction for operation or stop is recorded in the digital data DO by the control program, set to the operation terminal 40a of the equipment 4a via the remote IO module 3a, and instructed to operate or stop.
In the motor operated valve 42b, the operation instruction of the opening operation and the closing operation is recorded in the digital data DO by the control program, set to the operation terminals 40b and 40c of the equipment device 4d via the remote IO module 3b, and the valve opening is set. Is done.

As described above, the remote IO modules 3a and 3b detect a transmission abnormality in the serial transmission path 5 to which the digital data DO is transferred, and change the digital data DO based on a predetermined change rule.
In this embodiment, when a transmission abnormality is detected, the digital data DO is changed according to the following change rule for the fixed speed pump 42a and the motor operated valve 42b.

  In the remote IO module 3a, a change rule for holding the digital data DO instructing the operation of the fixed speed pump 42a in the setting state of the immediately preceding control cycle is set. That is, the current operation or stop state of the fixed speed pump 42a is maintained.

  In the remote IO module 3b, a change rule is set to clear the digital data DO instructing the opening and closing operations of the electric valve 42b (to prevent the opening or closing operation). That is, the opening and closing operations of the motorized valve 42b are stopped to fix the valve opening and maintain the current flow rate.

By setting the change rule of the digital data DO at the time of transmission abnormality of the fixed speed pump 42a and the motorized valve 42b of the water transportation plant of the present embodiment as described above, water transportation in the control cycle in which the transmission abnormality is detected is stopped. In addition, when the transmission returns to normal, the control can be easily resumed.
The above change rule is not fixed to this, and can be appropriately determined according to the operation specification at the time of abnormal transmission.

By the way, in the controller 1 of the water transport plant of the present embodiment shown in FIG. 12, the CPU status signal 6 notifies the CPU abnormality to the remote IO modules 3a, 3b, 3c from the CPU module 2.
The remote IO modules 3a, 3b, 3c notified of the CPU abnormality by the CPU status signal 6 set the operation terminals 40a, 40b, 40c to the insulated state with the digital data DO being “0”. That is, the fixed speed pump 42a stops the pump operation, and the motor operated valve 42b stops the opening operation or the closing operation, so that the outflow of the outflow water stops.

  When a CPU abnormality is detected, it may take time to restore the controller. For this reason, it is desirable that the fixed speed pump 42a and the electric valve 42b can be manually operated in order to cause the outflow water to flow out.

For this reason, for example, a switching device is provided in the device connection cable 7a of the operation terminal 4a of the fixed speed pump 42a so that a signal from the remote IO module 3a and a signal from the manual operation device can be selected.
When the fixed speed pump 42a stops due to a CPU abnormality, the switching device switches so that the operation terminal 4a of the fixed speed pump 42a and the manual operation device are connected. And the operation terminal 4a of the fixed speed pump 42a is made into a conduction | electrical_connection state with a manual operation apparatus, and a pump driving | operation is performed.

As described above, according to the present embodiment, when the controller 1 detects a fatal state of abnormality of the CPU module 2, the device connection output cable 7-1 is reliably insulated and all the equipment devices Can be stopped, so that malfunction of the plant can be prevented.
In addition, according to the present embodiment, a simple logic circuit can be mounted on the remote IO module without using a means such as a high-performance CPU, and a signal cable for notifying the state of the CPU module can be installed. Since the operation of the plant can be surely stopped at the time of abnormality, there is an effect that safety can be improved at low cost.

Further, if the CPU module 2 is normal, it is possible to select and set the continuation or stop of the output to the control device when the transmission abnormality of the serial transmission path 5 is detected. There is an effect that can respond flexibly.
In addition, the operation of all connected control devices is stopped only when a specific serious error factor such as a CPU error is detected. Therefore, the operation rate of automatic control is improved, and the burden of manual operation by the operator is expected to be reduced. it can.

The controller according to the present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the gist of the present invention. Hereinafter, other embodiments of the control controller according to the present invention will be listed.
In the above-described embodiment, the remote IO module 3 has a configuration including one DI and one DO. However, the remote IO module 3 may include a plurality of DIs and a plurality of DOs. It is good also as a structure provided with AO and PI.

Further, in the above-described embodiment, the state contact, the operation terminal, and the CPU state contact are a contact, but may be a b contact and a c contact.
The control controller 1 according to the above-described embodiment can also be applied to a control controller for social infrastructure systems such as electric power, gas, transportation, and dams, and a control controller for industrial systems such as steel, chemicals, food, and logistics.
In addition to storing information such as programs and data for realizing each function in a RAM (Random Access Memory), a recording device such as an SSD (Solid State Drive), an IC (Integrated Circuit) card, an SD (Secure It can be stored in a recording medium such as a Digital) card or DVD (Digital Versatile Disc).

In addition, the configuration, function, CPU, memory, and system bus of each unit according to the above-described embodiments can be realized in whole or in part by hardware designed by an integrated circuit.
In the drawings for explaining the embodiments, only control lines and information lines considered necessary for explanation are shown, and not all control lines and information lines on the product are necessarily shown. In practice, it can be considered that almost all configurations are connected to each other.

1 Controller 2 CPU module 3 3a 3b 3c Remote IO module 4 4a 4b 4c 4d 4e 4f 4g 4h 4i Equipment 5 Serial transmission path 6 CPU status signal 7a 7b 7c 7d 7e 7f 7g 7h 7i Equipment connection cable

Claims (5)

In the control controller that controls plant equipment,
A CPU module that has an abnormal state detection unit that detects an abnormal operation of the module, and that program-controls a plurality of equipment of the plant at a predetermined control cycle;
A plurality of remote IO modules that are daisy chain connected to the CPU module via a serial transmission path, convert digital data transmitted from the CPU module at each control cycle, and output the converted digital data to the equipment;
The remote IO module further includes a transmission abnormality control unit that detects a transmission abnormality in the serial transmission path and changes digital data, and the transmission abnormality control unit includes a plurality of facilities to be connected when a transmission abnormality is detected. For each device, digital data is changed based on a predetermined change rule set in advance via the serial transmission path,
The CPU module, when the abnormal state detection unit monitors the processing cycle of the program control and detects an abnormal operation due to processing exceeding a predetermined monitoring time, the CPU different from the serial transmission path With a signal cable that daisy chain connects the module and the remote IO module, the remote IO module is notified of the CPU abnormality,
When notified of the CPU abnormality, the remote IO module asynchronously outputs the digital data , isolates the output separately from the control based on the digital data , and puts all of the equipment into a stopped state. A controller characterized by that. The controller of claim 1,
The change rule rewrites digital data to “0” (zero clear), or
A controller for maintaining (holding) digital data before detection of a transmission abnormality. A control method of a control controller having a CPU module and a plurality of remote IO modules for controlling at least one equipment of a plant, and controlling a plurality of equipment of the plant,
By means of a serial transmission path that daisy chain connects the CPU module and the remote IO module for program-controlling a plurality of facility devices of the plant, the facility device is transferred from the CPU module to the remote IO module every predetermined control cycle. Transmitting digital data DO which is control information of the program control of
The CPU module monitors the processing cycle of the program control, and detects an abnormal operation when the processing exceeds a predetermined monitoring time. The CPU module and the remote IO module different from the serial transmission path Outputting a signal indicating that the CPU state is abnormal to a signal cable for daisy chaining;
The remote IO module that sets each operation terminal of the plurality of facility devices corresponding to the digital data DO notified from the CPU module,
The serial transmission path connecting the CPU module and the remote IO module is monitored at a predetermined control cycle, and when the transmission abnormality is detected, the digital data DO notified from the CPU module is passed through the serial transmission path in advance. Changing according to a predetermined change rule set by
When the CPU status signal indicates an abnormal state, the remote IO module is in an insulated state so that the equipment stops all the operation terminals separately from the digital data DO and asynchronously with the output of the digital data D0. Set, otherwise, output the digital data DO to the operation terminal;
A control method characterized by comprising: The control method according to claim 3, wherein
The timing at which the remote IO module sets the operation terminal corresponding to the digital data DO from the CPU module is different from the timing at which the operation terminal is set according to a signal indicating an abnormal state of the CPU status signal. A control method characterized by that. The control method according to claim 3, wherein
The remote IO module is
The step of setting the operation terminal according to a signal indicating an abnormal state of the CPU state signal, the step of changing the digital data DO notified from the CPU module according to a predetermined change rule, and setting the operation terminal as the operation terminal A control method characterized by processing with higher priority than the above.

Images