JPS5917467B2 - Control computer backup method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a backup method for rationally backing up a plurality of control computers using a shared standby computer.

Recent trends in control computers are moving away from the earlier format in which one computer or one set of redundant systems was associated with a relatively small-scale plant to form a single control system, and large-scale plants are now functioning. We are moving towards a system that can handle huge plants by configuring a multi-computer system in which each computer is separated and corresponds to one function, and each computer shares a database that has a mapping meaning for the entire plant.

In other words, whereas in the past a redundancy system was configured using multiple computers for a plant, recently the reliability of a single computer has improved dramatically due to advancements in hardware technology. There is a shift towards using computers to deal with multiple plants or large plants that combine multiple functions. By the way, even if the reliability of a single computer has improved, it does not mean that it is infinitely high, so an appropriate backup method must be devised to cope with the trends in multi-computer systems mentioned above. Must be.

Conventionally, the concepts of dual systems and duplex systems have been proposed as ways to improve the reliability of control systems using computers.

For future multi-computer systems such as those mentioned above, in which multiple computers each have separate functions, we will expand the idea of a duplex system rather than a dual system, and use a backup system with a shared standby computer. Adopting this method is considered to be effective and appropriate considering cost performance. In other words, a multi-computer system including M control computers,
Backup is performed using a smaller number of N (possibly N-1) spare control computers to deal with possible abnormalities or failures of the computers and to improve the reliability of the system. SUMMARY OF THE INVENTION It is an object of the present invention to provide a new M:N backup method that can fully address the above-mentioned trends in the prior art and can perform effective backups with a small amount of hardware. According to the present invention, when backing up a plurality of control computers with a smaller number of shared standby computers, each control computer is provided with a transmitter for transmitting a control object code.

These transmitting devices detect when an abnormality occurs in the corresponding computer, and transmit the code to be controlled by that computer.The control target code is read into a specific backup computer, and the backup computer is activated. Backup is started. In order to prevent backup conflicts that may occur when a plurality of backup computers are used, a management device is provided to determine which backup computer should read the transmitted control object code.

This management device includes means for registering the transmitted control object code and the code of the standby computer, and a backup command means for judging the registered contents and determining which standby machine to issue a backup command to. The idea of providing this management device was originally filed in the patent application filed in 1973 by the applicant.
Although it is also disclosed in No. 25187, the idea proposed earlier is aimed at a dual system, which is essentially different from the present invention, which is aimed at a dual system. Each transmitting device provided for each computer is equipped with a means to report to the management device that the computer has returned to normal from an abnormality, so that the computer that has returned to normal can be registered in the management device as a backup device. It is preferable to

The main hardware in the present invention is the transmitting device and the management device as described above.

In order for the management device to operate normally, at least the following two conditions must be satisfied. (1) It is possible to accurately detect an abnormality by visiting the computer where the abnormality has occurred.

(2) Not be affected by abnormal computers.

Condition (1) above includes the seemingly contradictory element that an abnormality report from an abnormal computer must be made normally, based on the premise that in principle only one computer is assigned to each controlled object.

This is because in the case of a dual system, a normal computer that survives the abnormality of a certain computer can detect and report it, but in the case of a dual system, such as the one that is the subject of this invention, a normal computer that survives is Therefore, a system may be considered in which the management device operates the system while constantly diagnosing the presence or absence of an abnormality. However, this method is not preferable because it requires a large amount of hardware for the management device, making it complicated, and the hardware becomes a completely unnecessary load when the system is normal.
According to one embodiment of the present invention, the above ( It is intended to satisfy the condition 1).

Further, in order to satisfy the condition (2) above, according to an embodiment of the present invention, special efforts are made to the power supply of the management device. If an independent power source is provided for the management device, if an abnormality occurs in that power source, backup operations will become impossible, and the reliability of the entire system will depend on the reliability of that power source. Therefore, according to the embodiment, the power supply of the management device is configured by an 0R power supply circuit that receives the output of the power supply of each control computer and supplies power under the 0R condition. If this is done, the management device will not become inoperable. This only occurs when the power supplies of all control computers fail. In this case, since there is no longer any reason for the existence of the management device, the above-mentioned power supply method can be said to be extremely rational. The abnormality transmission device and management device used in the present invention have the advantage of being compact in structure because of their very simple functions, having extremely high reliability compared to a control computer, and being inexpensive. I have it too.

The invention will now be described in detail with reference to embodiments shown in the accompanying drawings.

Figures 1a and 1b are 3:2 according to one embodiment of the present invention.
(M=3, N=2) The backup system is shown in an initial state and in an abnormal state, respectively.

Referring to FIG. 1a, in the initial state, among the control computers C1 to C5 for controlling the controlled object 10, C1 to C3 constitute the operating machine group 14a, and C4 and C5 constitute the backup machine group. 14b.

A bus line, which is the mainstream in recent system configuration methods, is used as a means of communication between the controlled object 10 and the control computers C1 to C5, and the connections between the buses can be switched by commands from the control computer. By the matrix type switch device 12? It will be done. In the illustrated example, switch elements 12a-1
2c is closed, and the computers C1~ of the operating machine group 14a
C3 is connected to each of the control objects 01 to 03 to control them. The computers C1 to C5 are connected to the management device 16 via a bidirectional signal transmission path 18, and each of the computers C1 to C5 serves as a power source for the management device 16.
The power output of 5 is now used under the 0R condition, and the power is supplied by the power transmission line 20. In the initial state, the computers C1 to C3 control the control objects 0 and 03, respectively, as described above. However, for example, when an abnormality (for example, a power outage) occurs in the computer C1, according to the present invention, the computer C4, which was previously in the standby group, is changed to C1 by switching the switch element 12d, as shown in FIG. 1b. Instead, it controls the controlled object 01 and backs up the normal operation of the system. Then, when the computer C1 returns to the normal state from the abnormal state, it is transferred to the spare machine group 14b? It will be done. Although not shown in FIGS. 1a and 1b, what makes such an operation possible is an abnormality transmission device and a management device. FIG. 2 shows in detail the management system in the above-mentioned backup system. In order to execute the operations described in FIGS. 1a and 1b, an abnormality transmission device 22 is installed for each computer. It is designed to detect an abnormality and send the control target code to the management device 16.
In FIG. 2, only the abnormality transmission device 22 provided in the computers C1 and C4 is shown, but the other computers C2 and C
3. A similar transmitter is also installed at C5. Each transmitting device 22 operates by being supplied with power from a corresponding computer, but is preferably configured to operate at a voltage level lower than the power failure detection level of the corresponding computer. The main function of each transmitting device 22 is to detect an abnormality, such as a power outage, in the corresponding computer, and to transmit the code of the control object that the corresponding abnormal computer has been controlling up to that point to the management device 16. Such a function can be easily achieved by using computer hardware (that is, devising a program) or by combining a small amount of known hardware. An input device 24 that receives the transmitted control object code, a registration device 26 that registers the received control object code, and computers in the backup machine group are registered in advance with a computer code that specifies each backup machine. The registration device 30 and the registration device 26 when receiving the input device 24, that is, when an abnormality occurs.
. In the code A.

．． A to H are added to correspond to each step of the time chart in Figure 3b in order to make it easier to understand the operation of the system in Figure 2, which will be explained next with reference to Figures 3a and 3b. be. The operation of the abnormality transmission device starts when the program or hardware logic detects an abnormality that should cause the system to go down.
The flow of control will be explained regarding the transition from FIG. to FIG. 1b). Referring to FIGS. 3a and 3b, before the time of TO, the computer C1 normally controls the controlled object 0. However, if a power outage occurs in the computer's power supply at the time of TO, the power supply voltage will gradually drop as shown in Figure 3a. This is because it has become possible to cope with momentary power outages by using the functions of capacitors, etc. The computer C1 detects the power supply voltage that has reached the power outage detection level L1 at time t1, and a power outage interrupt is performed accordingly. Therefore, the computer C1 performs data storage processing as much as possible by the program. In this embodiment, at the same time as the power failure interrupt, t
At time 1, the transmitting device of computer C1 starts operating as shown in FIG. 3b. 0 This operation continues until time T2, when the power supply voltage drops to match the lowest level L2 at which the device can operate. It will be done. That is, the transmitter transmits the signal at time t1.
~ T2, the management device 16 is started and the corresponding computer C
1 reports the code of controlled object 01 that it was in charge of to the management device (step A). Note that even if the power supply of the computer C1 fails, since the power supply of the management device 16 is supplied with 0R power, it will not be affected by the failure. Immediately upon receiving the controlled object code signal, the input device 24 in the management device 16 causes the controlled object registration device 26 to register the code of object 01 (step B), and at the same time activates the backup command device 28 (step C).

The codes of the computers C4 and C5 are registered in advance in the standby machine registration device 30 at the time when the computers C4 and C5 become capable of being backed up (Step A). When the backup command device 28 starts up, the program P1 shown in FIG.
8 operations are performed. As shown in Figure 2, 01 is the control target code, and C4 and C5 are the backup computers.
are registered respectively, so A, b, c, d in Figure 4
. (Step F) o Meanwhile, the computer C4 runs the program P shown in FIG.
2, the processing proceeds in the order of G, h, i, and j, and after a slight overhead time has elapsed, the controller 0 that controls the control object 01 in place of the computer C1, as shown in FIG. In process g of the backup computer program P2, the backup computer reads the control object code (step G).
), the control object code is reset and updated in process h, and at the same time, the backup command device 28 is activated (step H, broken line in FIG. 4). However, since the control object code 01 has now been reset in the backup command device program P1, the operation is completed by only processing a and b. The transmitting device according to this embodiment is capable of returning from an abnormal state to a normal state (
For example, computer C1 is configured to be able to detect a power outage and return to the original power supply state and send it to the management device, so that after the power is restored, computer C1 is prepared for backup and is used as a backup computer by the management device. It is registered in the reserve meter registration device 30 in 16.

In this way, a plurality of computers can sequentially take over one control target, so interruptions in control are almost avoided, and highly reliable backup is possible. In the above description, an example was given in which the computer and the controlled object are communicated using a bus and a matrix switch, but a data freeway 32 may also be used as an example of a simpler configuration as shown in FIGS. 5 and 6. In the example shown in FIG. 6, communication between the management device 16 and each of the computers C1 to C5 is also performed via the data freeway 32.
As another modification, it is possible to send the control object code to the backup computer at the same time as the backup command based on the operation logic shown in Fig. 4. Regarding the program shown in Fig. 4,
The processing of g and h is performed on the computer side with the intention of also serving as a response from the backup computer, but when sending the backup command and the control target code at the same time as described above, the processing on the management device side is Also, in the above-mentioned embodiment, continuity of software is not taken into consideration.

This is because various countermeasures can be considered depending on how this system is used. For example, one method is to provide a shared auxiliary storage device on the bus line that can be accessed by each computer, and at the time of backup, the operating system (OS) can install software corresponding to the control target that will take over control.
A possible method is to make a selection based on the judgment and load it. As described in detail above, the backup method of the present invention provides excellent effects such as being able to effectively back up a multi-computer system with high reliability using only a small amount of hardware.

[Brief explanation of drawings]

Figures 1a and 1b are 3:2 according to one embodiment of the present invention.
2 is a block diagram showing the backup system in an initial state and an abnormal state, respectively. FIG. 2 is a block diagram showing in detail the management system for the system of FIG. 1. FIGS. 4 is a flowchart showing a sequence for performing a backup operation, and FIGS. 5 and 6 are block diagrams showing a modification of the present invention using a data freeway. 〇Explanation of the symbol, 10...
... Controlled object, 12 ... Matrix type switch device, 14a ... Control computer in operation, 14
b...Spare control computer, 16...
Management device, 18... Signal transmission path, 20...
...Power transmission line, 22... Abnormality transmission device, 2
4...Input device, 26...Controlled object registration device, 28...Backup command device, 30
......Spare machine registration device, 32...Data Freeway.

Claims (1)

[Claims] 1. In a backup method for backing up a plurality of control computers each controlling a controlled object using a smaller number of shared standby computers, an abnormality occurs in each of the control computers. A transmitting device is provided for detecting the object code and transmitting an object code indicating the object to be controlled, and a management device is provided for determining which computer among the backup computers should read the object code, the management device comprising: a first registration means for registering the transmitted target code; a second registration means for registering the backup computer by a computer code that identifies it; and a backup command means for reading out the registered contents of the second registration means, determining a specific backup computer to read a specific target code, and instructing execution of the determined result, and corresponding to each of the above-mentioned transmitting devices. 1. A backup method, comprising means for transmitting to said management device that a computer returned to a normal state has been returned to a normal state, so that said management device can register said computer as a standby computer. 2. In the backup method according to claim 1, the power supply of the management device is configured by an OR power supply circuit that receives the output of the power supply of each of the control computer and the standby computer and supplies power under an OR condition. A backup method featuring: 3. In the backup system according to claim 1 or 2, each of the transmitting devices is configured to be powered by a corresponding computer and to operate at a voltage level lower than its power outage detection level. backup method.