JP4600771B2 - Control device - Google Patents

Description

  The present invention relates to a fail-safe function in a control device that outputs a control value from a host system to a field device of a plant via an input / output module (hereinafter abbreviated as IOM).

  There is an integrated control system that integrates a distributed control system that controls plant equipment and a safety system that uses the control bus in common and performs stop control on the safe side in response to a trip request from the plant side.

  FIG. 4 is a functional block diagram showing a configuration example of a conventional integrated control system. The integrated control system includes a safety system 1 and a control system 2. A control bus 3 is commonly used by both systems. Reference numeral 4 denotes a plant to be controlled.

  The safety system 1 is an engineering device 5 connected to the control bus 3 and a safety device that is connected to the control bus 3 and communicates with the engineering device 5 and performs stop control on the safe side in response to a trip request from the plant 4 equipment. The control device 6 is hierarchically configured.

  The control system 2 is hierarchically controlled by an operation monitoring device 7 connected to the control bus 3 and a control device 8 connected to the control bus 3 to communicate with the operation monitoring device 7 and control the field devices of the plant 4. It is configured.

  The safety control device 6 corresponds to the field device of the plant 4 and includes a host system 9 composed of applications of a plurality of channels CH1 to CHn, and a plurality of channels CH1 that obtain control values from each channel and output them to the field device of the plant 4 Thru / or CHn modules.

  In each channel of the host system 9, 9a is a first switching means. By default, the control value is selected and set in the host command value holding means 9b, and when the CPU 9c acquires IOM abnormality information by communication, the command Thus, the fail safe value is selected and set in the upper command value holding means 9b.

  In each channel of the IOM 10, 10a is a self-returning type second switching means. By default, the upper command value of the upper command value holding means 9b is selected via the communication W1, and when IOM abnormality information is acquired, fail safe A value is selected and output to the output value holding means 10b to the plant 4.

  10c is a diagnostic means for diagnosing a wiring abnormality of each IOM channel, outputting a normal signal “0” and an abnormal signal “1”, and in case of abnormality, the second switching means 10a is switched to set a fail safe value. The output value holding means 10b is caused to output, and a wiring abnormality is notified to the CPU 9c of the host system via the communication W2.

  When the wiring abnormality is recovered, the second switching unit 10a selects the upper command value of the upper command value holding unit 9b with the immediate self-return characteristic and outputs it to the output value holding unit 10b. The first switching means 9a sets the control value in the higher order command value holding means 9b after the CPU processing time has elapsed.

  Fail-safe switching due to an IOM abnormality is performed only on the host system side in a normal control device, but there are cases where safety control devices etc. want to fail-safe urgently (faster) and fail on the IOM side as well. Design to provide safe switching function.

  Patent Document 1 describes a system for detecting an abnormality of an I / O card (input / output card).

Utility Model Registration No. 2518829

  As described above, in the configuration in which the means for changing to the fail-safe value is provided redundantly in the host system and the IOM, an output bump may occur if the operations of the two switching means are not synchronized.

  FIG. 5 is a sequence diagram for explaining generation of output bumps. If a wiring failure occurs at time t1, the IOM outputs a failsafe value, and when the upper level failsafe setting is delayed when the wiring returns and self-recovers at time t2, failsafe setting is completed. Since the intermediate higher command value holding means 19b is set to the control value, the bump that the output once becomes the control value at time t2 and changes to the fail safe value at the timing of completion of the fail safe setting at time t3. appear.

  FIG. 6 is a functional block diagram showing an example of the configuration of a control device that provides the return processing means in the host system to avoid bumps. The difference in configuration from FIG. 4 is that the first switching means 9a is not provided for each channel on the host system 9 side, but one common is provided, and the second switching means 10a is not provided for each channel on the IOM 10 side. One is provided in common.

  In this case, the second switching means 10a is not a self-return type. When a wiring abnormality is notified from the diagnosis unit 10c, the second switching unit 10a selects a fail safe value and sets the output values of all the IOM channels as fail safe values.

  Reference numeral 9d denotes a return processing means provided in common in the host system 9, and operates according to a command from the CPU 9c. When the wiring abnormality is notified to the CPU 9c via the communication W2, the CPU 9c performs the fail safe setting by the first switching means 9a.

  When the normal return is notified to the CPU 9c via the communication W2, the CPU 9c executes the switching setting to the control value by the first switching means 9a and instructs the return processing means 9d to send the IOM 10 via the communication W3. The second switching means 10a is switched to set the channel output values of all the IOMs to the upper command value.

  In this embodiment, an output bump does not occur by a method of performing recovery by performing a recovery process from the host system side after normal recovery. In this method, since the restart sequence can be performed in a lump, bumpless switching can be realized with a relatively simple configuration, but there is a problem that affects the output of all channels when a wiring abnormality occurs.

  FIG. 7 is a functional block diagram showing another example of the configuration of the control device for avoiding the bump by providing the return processing means 9d in the host system. In this configuration, if an IOM wiring abnormality is found as in FIG. 4, only the target channel outputs fail-safe.

  In this embodiment, after the wiring is restored, the IOM channel in which an abnormality has occurred is restored by the restoration processing means 9d provided for each corresponding channel in the host system. In this method, a restart sequence is required for each channel, and the configuration of the application becomes complicated. Furthermore, a return sequence process is required for each channel.

  The present invention has been made to solve the above-described problems. If an IOM wiring abnormality is found, only the corresponding channel is reliably fail-safe, and each channel is bumpless with a simple interface when the wiring returns to normal. The purpose is to realize a control device that can output the upper command value to the plant.

In order to achieve such a subject, the present invention has the following configuration.
(1) Provided in the host system that outputs the control value to the plant field device via the input / output module. When the abnormal information of the input / output module is acquired, the control value is switched to the fail-safe value and the normal return information is acquired. Then, a first switching means for switching to the control value,
A second switching means provided in the input / output module, which switches the command value from the host system to a fail-safe value when acquiring abnormality information of the input / output module, and switches to the command value when acquiring normal return information; ,
A return delay means for switching the second switching means to an immediate fail-safe value at the time of obtaining the abnormality information and delaying the return of the second switching means for a predetermined time;
A control device comprising:

(2) The control device according to (1), wherein a delay time of the return delay means is set longer than a switching time of the first switching means.

(3) The control device according to (1) or (2), wherein the first and second switching means and the return delay means are provided for each channel of the input / output module.

(4) The control device according to any one of (1) to (3), wherein the abnormality information of the input / output module is wiring abnormality information.

(5) The control according to any one of (1) to (4), wherein the control device is a safety control device that receives a trip request from the plant and operates the plant to a safe side. apparatus.

(6) The return delay means outputs an abnormal signal to the second switching means for a predetermined time after the normal return information is acquired, and delays the return of the second switching means for a predetermined time. The control device according to any one of (1) to (5).

(7) The return delay means outputs a normal signal to the second switching means after a predetermined time delay from the acquisition of normal return information, and delays the return of the second switching means for a predetermined time. The control device according to any one of (1) to (5).

(8) The control device according to any one of (1) to (7), wherein a management unit that collectively manages a predetermined time of the return delay unit is provided for all channels of the input / output module.

As is apparent from the above description, the present invention has the following effects.
(1) By delaying the self-recovery of the switching means on the IOM side for a predetermined time, the IOM self-recovery is executed after the fail-safe setting on the host system side is surely executed, thereby ensuring reliable failure of the wiring abnormality channel. Safe setting is possible.

(2) This makes it possible to perform a bumpless self-recovery by using an immediate fail-safe in case of wiring abnormality and using a fail-safe setting on the host system side in normal recovery.

(3) The constituent elements for carrying out the invention are only simple return delay means, and a low-cost and simple interface configuration is possible.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a functional block diagram showing a main part of an embodiment of a control device to which the present invention is applied. The same elements as those of the conventional apparatus described with reference to FIG. Hereinafter, the characteristic part of the present invention will be described.

In FIG. 1, a dotted line block 100 provided in the IOM 10 is a return delay unit that forms a feature of the present invention, and is inserted and connected between the diagnostic unit 10 c and the second switching unit 10 a. The return delay means 100 includes an off-delay timer and an OR logic circuit.

  When the return delay means 100 acquires the abnormal signal “1” from the diagnostic means 10c, the return delay means 100 immediately transmits the abnormal signal “1” to the second switching means 10a to voluntarily switch the output value of the IOM to the fail-safe value.

  When the CPU 9c of the host system is notified of the wiring abnormality from the IOM side via the communication W2, the CPU 9c switches the first switching unit 9a and transmits the fail safe setting of the abnormal channel to the IOM side.

  The recovery delay means 100 obtains the abnormality information and then continues the abnormality signal “1” for a predetermined time (4 seconds in the figure) and outputs it to the second switching means 10a. Thereby, the self-recovery of the second switching means 10a is delayed for a predetermined time.

The delay time set in the return delay means 100 is set sufficiently longer than the switching time of the first switching means 9a operated by a command of the CPU 10c. As a result, the wiring is restored to the normal state before the first switching means 9a is operated due to the wiring abnormality and the fail safe value is set in the upper command value holding means 9b (the control value is held), and the second When the changeover switch self-returns, the output value bumps that are generated by the output of the control value still held in the higher order command value holding means 9b are avoided.

  FIG. 2 is a sequence diagram illustrating the absence of output bumps. 2A shows an operation sequence of the first switching unit 9a of the host system 9, and FIG. 2B shows an operation sequence of the second switching unit 10a of the IOM 10.

  A wiring abnormality occurs at time t1, and the second switching means 10a switches from on to off. The wiring abnormality information is notified to the CPU of the host system, the first switching means 9a is switched from ON to OFF at time t2, and the host command value is set to the fail safe value after t2.

  The return delay means 100 forcibly turns off the second switching means 10a for a period from time t2 to time t3 (4 seconds), and restarts the switching operation by self-diagnosis after time t3. The fail safe value is acquired as a command value.

  Even if the wiring recovers normally between time t1 and time t2, since the second switching means 10a is forcibly turned off at this time, the control value of the host system is acquired as the command value. The output value will not bump.

  The return delay means 100 in the embodiment of FIG. 1 operates so that the second switching means 10a is forcibly turned off for a predetermined time when a wiring abnormality occurs, but the delay time may be set when the wiring returns to normal. The same effect can be obtained.

  FIG. 3 is a functional block diagram showing a main part of another embodiment of the control device to which the present invention is applied. When the return delay means 200 obtains the abnormal signal “1” from the diagnostic means 10c, the return delay means 200 immediately transmits the abnormal signal “1” to the second switching means 10a and spontaneously switches the output value of the IOM to the fail-safe value.

  When the CPU 9c of the host system is notified of the wiring abnormality from the IOM side via the communication W2, the CPU 9c switches the first switching unit 9a and transmits the fail safe setting of the abnormal channel to the IOM side.

  The return delay means 200 delays the output of the normal signal “0” by a predetermined time (4 seconds in the figure) and outputs it to the second switching means 10a even if the wiring returns to normal. Thereby, the self-recovery of the second switching means 10a is delayed.

  In this embodiment, the route R1 for notifying the output of the diagnosis unit 10c as it is and the route R2 for notifying the output of the return delay unit 200 as the route for notifying the diagnosis result of the wiring abnormality to the host system as in FIG. You can choose.

Note that a management unit that collectively manages a predetermined time (4 seconds in the drawing) of the return delay unit 100 may be provided for all channels of the IOM 10. This management means may be provided inside the IOM 10 or outside the IOM 10.

  In the embodiment of FIGS. 1 and 3 described above, the case where the present invention is applied to the safety control device is illustrated, but the scope of the present invention is not limited to the safety control device. Can be generally applied to a control device that outputs the data via the IOM.

It is a functional block diagram which shows the principal part of one Embodiment of the control apparatus to which this invention is applied. FIG. 11 is a sequence diagram for explaining the absence of an output bump. It is a functional block diagram which shows the principal part of other embodiment of the control apparatus to which this invention is applied. It is a functional block diagram which shows the structural example of the conventional integrated control system. It is a sequence diagram explaining generation | occurrence | production of an output bump. It is a functional block diagram which shows the structural example of the control apparatus which provides a return process means in a high-order system, and avoids a bump. It is a functional block which shows the other structural example of the control apparatus which provides a figure reset process means in a high-order system, and avoids a bump.

Explanation of symbols

9 Host system 9a First switching means 9b Upper command value holding means 9c CPU
10 IOM
10a Second switching means 10b Output value holding means 10c Diagnosis means 100 Return delay means

Claims (8)

Provided in a host system that outputs a control value to a field device of the plant via an input / output module. When the abnormality information of the input / output module is acquired, the control value is switched to a fail-safe value, and when normal return information is acquired, the control First switching means for switching to a value;
A second switching means provided in the input / output module, which switches the command value from the host system to a fail-safe value when acquiring abnormality information of the input / output module, and switches to the command value when acquiring normal return information; ,
A return delay means for switching the second switching means to an immediate fail-safe value at the time of obtaining the abnormality information and delaying the return of the second switching means for a predetermined time;
A control device comprising: 2. The control apparatus according to claim 1, wherein a delay time of the return delay means is set longer than a switching time of the first switching means. 3. The control apparatus according to claim 1, wherein the first and second switching means and the return delay means are provided for each channel of the input / output module. The control device according to claim 1, wherein the abnormality information of the input / output module is wiring abnormality information. The control device according to any one of claims 1 to 4, wherein the control device is a safety control device that receives a trip request from the plant and operates the plant to a safe side. The return delay means outputs an abnormal signal to the second switching means for a predetermined time after the normal return information is acquired, and delays the return of the second switching means for a predetermined time. The control device according to claim 1. The return delay means outputs a normal signal to the second switching means after a predetermined time delay from when normal return information is acquired, and delays the return of the second switching means for a predetermined time. The control device according to claim 1. 8. The control apparatus according to claim 1, further comprising a management unit that collectively manages a predetermined time of the return delay unit for all channels of the input / output module.

Images