JPS5864502A - Plant decentralized control method - Google Patents

Abstract

PURPOSE:To perform the efficient operation of a controller, by holding a control program that at least a self-controller should execute originally, and reconstituting and executing a high-importance control program part that a controller relating to a fault and the self-controller should execute. CONSTITUTION:Controllers A, B, and C coupld together through a host electronic computer 1 input detection outputs from detectors assigned to them and also process those detection outputs properly to control an operating device. If a fault occurs to the controller A and that is detected by a watch dock timer, etc., a switching part 9A is switched to inform the controller B of that through a communication line 4A and a bus line 2. Consequently, the controller B exercises switching control over a switching part 9B to equip itself with a detector 10A and an operating device 11A, and a control program is reconstituted by using a high-importance control program part that the controller A should execute and a high-importance control program part that the controller B should execute, and then executed.

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a method for distributed control of a plant, and particularly to a method for controlling a plant in a distributed manner, in particular, without unnecessarily increasing the memory capacity of a plurality of distributed control controllers, even if any controller fails. It concerns a method by which a plant can be controlled without any hindrance.

Conventionally, for example, in an atomic coupler control system, as the number of objects to be controlled increases, it becomes dangerous to control them with a single plant control controller, so the control is distributed in a distributed manner using multiple plant control controllers. It is designed to control the target. In this type of distributed control, if any plant controller fails, the remaining normal plant controllers take over the function, but in the past, However, the control system itself is uneconomical, the connection between the controllers is complicated, and the memory capacity for storing the control program in each controller must be unnecessarily increased. There is.

In other words, in the past, from the perspective of achieving high control reliability, control systems were generally configured as redundant systems such as duplex systems or 2-out OP3 systems, or backup systems such as 8-to-1 backup systems. It is. however,
When configured as a redundant system, it cannot be denied that the system configuration becomes uneconomical. In addition, when configured as a backup system, not only does the connection with the backup controller become complicated, but also the connection between the backup controller and the backup controller becomes complicated.
Because it is necessary to take over and execute all the functions of other controllers, there is a drawback that the capacity of the memory for storing control programs must be increased as the number of controllers and objects to be controlled increases.

For this reason, control systems are being considered in which the controller is not configured as a redundant secondary backup system, but in the event that one of the multiple controllers fails, another controller executes its function in its place. Although multiple controllers back up each other, such control systems are not without their problems. I mean,
This is because, in order to back up each other, each controller 2 needs to have a built-in control program executed by the other controller in order to execute all the functions of the other controller. Under normal circumstances, each controller does not have to execute any number of control programs executed by other controllers, but in the event that another controller fails, that controller will take over and execute the control program that should be executed. It is what it is. therefore,
The controller in such a control system must have a large memory capacity, and distributed control cannot be carried out economically.

Therefore, an object of the present invention is to economically control a plant without unnecessarily increasing the memory capacity of each distributed control controller, and without causing any trouble even if any controller fails. The purpose of the present invention is to provide a distributed control method.

For this purpose, the present invention provides that the control program that each controller should originally execute may be different from various control program parts, but the importance of these control program parts is generally not the same, and less important ones are not executed. This was done by focusing on the fact that there is no particular problem for the time being. That is.

Each controller is pre-loaded with at least a control program that should be executed by itself, and if one of the controllers fails, the predetermined controller will take over and execute the functions of that controller. The control program is reorganized into two highly important control program parts, and the control program related to the reorganization is executed. When reorganizing the control program, if the controller does not have a built-in control program for the controller involved in the failure, it directly or indirectly receives the control program part that is more important than the controller involved in the failure, and executes the control program that should be executed by itself. It is executed in place of less important control program parts.

The present invention will be explained below with reference to FIGS. 1 to tIc4.

First, FIG. 1 shows the system configuration of an example of a plant distributed control system according to the present invention.

As shown in the figure, there are three controllers A for distributed control.

B and C are pass lines 2-1. Take pass line 2. They are directly or indirectly connected via the host computer 1, and the pot controllers A, B, and C normally input the detection output from the detector assigned to them, and also process the detection output appropriately. to control the operating device. Code 10 people.

10B, IOC is the detector, and 11A.

Although 11B and IIC indicate operating devices, it goes without saying that each of the controllers A, B, and C actually accommodates a plurality of various detectors and operating devices. By the way, the controllers A, B, and C are configured identically. To explain the configuration of controller A, there are three CPU sections and memory sections 6A and 7A.

It consists of a process input/output section 8A, a compensation section 4A, a program reorganization section 5A, and a switching section 9A, but the situation is similar for the other controllers B and C.

Of the memory sections 6A and 7A, the memory section 6A is provided for storing control programs, and the memory section 7A is provided for storing the operating system (O8) and basic control subroutines (proportional, integral, differential control, limiter, etc.). However, what should be noted here is the type of control program stored in the six memory units. It goes without saying that the six memory units store the control program that should originally be executed by controller A, but in some cases, the control program that should originally be executed by either controllers B or C is also stored there. . This is because if all of the control programs that controllers B and C should originally execute are stored, there is no difference in memory capacity from the prior art. The situation is exactly the same regarding the control programs stored in the memory units 6B and 6C in the controllers B and C.

Now, if the controller fails, controller B becomes Puntro? If controller B is out of order, controller C will take over the functions, and if controller C is out of order, the controller person will take over the respective functions.
The memory units 6A, 611゜6C store at least the control programs that the controllers A, D, and C should originally execute, and in some cases, the memory units 6A, 6B, and 6C further store the control programs that the controllers C, A, and B should originally execute. This means that the control program to be executed is stored. In normal times, each controller A, I3.0 accommodates the detectors and operating devices assigned to it via the switching section and process input/output section, and executes the control program that it should originally execute. , the entire plant is controlled in a distributed manner, but if any of controllers A, B, or C fails in such a state, the controller adjacent to the failed controller will take over the function. be.

For example, if the controller malfunctions, the malfunction is detected by a watchdog timer or the like, which controls the switching section 9A to switch the detector 10A1 operating device 11.
A is connected to relay signal lines 12AB and 12BA, respectively. On the other hand, the failure of the controller is directly or indirectly reported to the controller B via the communication section 4A and the path line 2, and the controller B takes necessary measures. That is, the controller B immediately controls the switching section 9B't-to switch the detector 10.
A. It also houses the operating device 11A and reorganizes the control program. In this case, the reorganization is performed by the program reorganization section 5B, but the memory section 6B
The mode of organization differs slightly depending on whether the entire control program or a highly important control program part that is originally to be executed by the controller is stored in the program. If it is stored in the memory unit 6B, the highly important control program portion is stored in the controller.

Controller B extracts the control program that should originally be executed and reorganizes it, and controller B executes the control program related to the reorganization. However, if it is not stored, the control program is more important than controller A. This is because reorganization takes place after the parts are received.

Even if controllers B and C fail, controllers C and A will take over and execute the functions of controllers B and N related to the failure in the same way as in the above case. According to the present invention, even if all but one controller fails, the plant can be controlled φf without any particular trouble. For example, in FIG. 1, if controllers A and B fail, controller C takes over the functions of controllers A and B. In the switching section of the failed controller, the detectors and operating devices that had been housed up to that point are accommodated and connected to the relay signal lines on both sides of the switching section.
If necessary, the normal controller can receive control program parts that are more important than the faulty controller and reorganize the control program. Although the content of the present invention has been briefly described for the case where there are three controllers, the present invention is generally applicable to a plant distributed control system having two or more controllers.

However, the switching units in each controller must be arranged in a loop via relay signal lines.

Although the present invention is as described above, the present invention will be explained in more detail below assuming a basic case. Assuming that each controller has only the control program that it is supposed to execute in its memory, if one of the controllers fails, the adjacent controller will not, in principle, be able to take over and execute that function. As already mentioned, FIG. 2 shows how the storage state of the control program in the memory section of the controller that takes over the function of the failed controller changes. That is, Fig. 2(a) shows that before the failure, and
FIG. 2(b) shows it after the failure.

As shown in the figure, in this example, the memory section 6 is 1000 in hexadecimal notation.
The memory area is divided into 15 PFs from the address, and each memory area is divided into 6 equal parts, and a control program part is stored in a length of 256 bytes. A 1-byte long label that specifies the control program portion is stored at the start address of each memo (11) area, and the control program is reorganized as described later using this label. In this example, the upper 3 bits that make up the label indicate the controller-specific program name, the lower 2 bits indicate the importance of the control program section, and the central 3 bits indicate the execution order of the control program section. It has become. So, for example, if the label is "001010"
11", the label can be displayed as (123) by dividing the bit interval as shown below, and from this, the control program part with this label is the control program of the controller that performs the function in its place. It is known that it constitutes a part of , has an importance level of 3, and is executed second. However, in this example, the smaller the value, the more important the importance is.

The manner in which the control program portion is stored in the memory unit 6 under normal conditions is as shown in Figure 2 (a). However, if an adjacent controller fails, the control program part (12) is stored in the controller (12), which is more important than the controller. The idea is to receive program parts and store those control program parts in a predetermined order in a memory area where control program parts of lower importance are stored. The control program parts (210), (231), and (241) in FIG. 2 (b) are of course from the faulty controller, and the program name unique to the faulty controller is displayed as "2". This is what is being done. The controller that executes the functions on its behalf executes control programs related to the reorganization, for example (110), (130), and (151).

By sequentially executing steps (210), (231), and (241), the functions of the controller related to the failure can be executed on behalf of the controller. In this way, when backing up the functions of a controller related to a failure, even if parts of the control program with low importance are no longer executed, those with high importance can be executed despite the failure of the controller. No major problems will arise for the time being.

(13) By the way, when executing the control progera A related to the reorganization or re-creation of the control program as described above, it is necessary to search for the less important control program parts and display the start address of the controller related to the failure. Care must be taken to smoothly and quickly store highly important control program parts from the beginning into the memory section, and to generate and display the start address corresponding to the control program part to be executed. The program reorganization section was prepared to facilitate these operations.

FIG. 3 shows the configuration of the program reorganization section. As already mentioned, if any controller malfunctions, that fact is reported to the CPU unit via the communication unit, bus twin, etc., and further via the communication unit of the controller that takes over the function of that controller. This causes the CPU section to start up the program reorganization section 5 via the path line inside the controller. When the program reorganization unit 5 is activated, its control circuit 5b first sets a value of low importance in the label input register 5d (14). In the examples shown in FIGS. 2(a) and 2(b), the value "3" is first set.

The following explanation will be given according to the example shown in FIGS. 2(a) and 2(b). If this importance value is compared with the label stored in the associative memo +)5f via the mask register 5C,
Labels (123) and (163) whose importance levels match are flagged to the effect that they match.

The matching register 5g is similar to the bit corresponding to the label, but
A flag is set at the bit position corresponding to the label whose importance level matches. By updating the importance value in the label input register 5d within an appropriate range and setting flags in the collation register 5g one after another, five control program parts with low importance can be detected, and based on the flag information. The starting addresses of these control program portions are generated by a real address generation circuit 5h and stored in an address register 51 in a predetermined order. On the other hand, the control program parts with high importance from the controller related to the failure are output from the communication section to the path line in order of importance15), and the communication section is sent to the controller 2, which directly or indirectly takes over and executes the function. After being input through the program reorganization unit 5, the data is temporarily stored in a buffer register 5a of the program reorganization unit 5. However, if the DMA control circuit 5C DMA transfers the control program portion to the backup memory 5a, 1:t) memory section based on the start address stored in the address register 5N, the control program that was previously of low importance can be transferred to the backup memory 5a, 1:t). In the memory area where the parts were stored, control program parts of high importance from the controller related to the failure are stored in a predetermined order.

When the storage of the control program portion in the memory section is completed, the reorganization of the control program is also completed, but after this, the controller executes the control program related to the reorganization. In this execution, the control program portions are not necessarily executed sequentially from address 1000tlt to address 15FF.

In the example shown in FIG. 2(b) already mentioned, the control program portions are executed in the order of the numbers displayed inside the circles, but such execution order control is performed as follows (16). . That is, the CPU section first sends (11X) to the program reorganization section 5 when executing the control program. However, the value of X indicating the degree of importance may be any value in this case. (IIX) is manually input to the control circuit 5b via the DMA control circuit 5C, and then -) Bell input register 5
d, and is compared with the contents of the content addressable memory 5f via the mask register 5e while ignoring the importance level.

When the control program is executed, the contents stored in the associative memory 5f are as shown in FIG. A flag is set at the bit position. Therefore, the actual start address of the control program portion to be executed based on the flagged bit position number Y can be determined in hexadecimal notation as follows.

Real start address = HOOO + TOOX (bit position/by Y) The real start address is determined by the real address generation circuit 5h as (17), and this is sent to the CPU section via the address register 51° control circuit 5b, etc. C by being
The PU section first executes the control program 2 part corresponding to the label (110). After this execution is completed, the CPU section will send the label (12 ). If a flag is set for a label sent in this way, the control program part corresponding to that label is executed, and if the control program part finishes executing or the hook is not set, the execution order is updated. The label is sent to the program reorganization section 5. After the CPU unit sends the label (16X), the label (
21X).

(22X), (23X), (24X), (25X).

By sequentially sending (26X), the control program portions can be executed in a predetermined order as described above. Note that it is also possible to use a normal memory instead of the associative memory 5f and write the labels in it (18) and then read them sequentially and compare them with the collation labels, but this takes a lot of time.

The present invention has been described above regarding the most basic case, but if the controller that takes over the function of the failed controller has a control program for the failed controller in its memory section, the switching unit Of course, it is possible to back up immediately after controlling the switching. If a failed controller is backed up and a controller to be backed up fails, the control program portion of that controller is obtained and the control program is further reorganized.

In general, distributed control is more efficient when a controller contains control programs for other controllers, but on the other hand, an increase in memory capacity is inevitable. However, if each controller is provided with the minimum necessary control program in advance, the memory capacity will not be increased unnecessarily, and even if a failure occurs in one of the controllers (19), the functionality of the entire plant will be maintained. This makes it possible to perform more distributed control than the necessary minimum level without causing any particular hindrance to the system.

In a distributed control system to which the present invention is applied, the control function will not be lost unless all controllers fail at the same time, and it is possible to repair the failed controller without stopping the plant. from,
For example, it is very effective for plants that require high reliability and high safety, such as nuclear couplants, and is also economically viable.

As explained above, the present invention does not require each controller to store all of the control programs to be executed by the other remaining controllers, but stores at least the control program that it should originally execute. In the event of a failure, a predetermined controller 2 receives a control program part that is more important than the controller involved in the failure, as necessary, and selects the control program part that is more important to be executed by the controller involved in the failure and the control program part that should be executed by itself. The control (20) program is reorganized from the highly important control program 2 part, and then this reorganized control program is executed.

Therefore, in the case of the present invention, it is possible to economically control the plant without causing any trouble even if any of the controllers breaks down, without unnecessarily increasing the memory capacity of each controller. There is.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing a system configuration of an example of a plant distributed control system according to the present invention, and FIG. 2(a). (b) is a diagram showing an example of the storage state of the control program in the memory section and its storage state after reorganization; FIG. 3 is a diagram showing the configuration of an example of the program reorganization section in FIG. 1; , FIG. 4 is an explanatory diagram of operations centered on the associative memory during execution of the reorganized control program. 2... Bus twin, 3A to 3c... CPU section, 5A
~5C25...Program reorganization section, 6A~6c, 6
...(For control program storage) Memory section, 88 to 8C
...Process input/output section, 9A to 9C...Switching section, (
21) 10A-100...detector, IIA-11C... operating device. Agent Patent attorney Masami Akimoto (22) 2 Figure (1))

Claims (1)

[Claims] 16 In a system in which a plurality of controllers are directly or indirectly connected to each other via an external path line or a host computer to perform distributed control over a plant, each controller stores all of the control programs executed by other controllers. Rather than storing at least its original control program, if any controller breaks down, the control object and detector that were connected to and housed in that controller are connected to and housed in a predetermined controller. The controller receives a control program part that is more important than the faulty controller as necessary, and divides the faulty controller into a highly important control program part that should be executed by the faulty controller and a highly important control program part that should be executed by itself. 1. A plant distributed control method, characterized in that a control program is reorganized from a computer, and then the program is executed.