JPS5918740B2 - multiple computer system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a multi-computer system in which a plurality of computers each including an arithmetic control device, an auxiliary storage device, and a peripheral device control device are interconnected.

Recently, process digital computers have been employed to monitor and control process quantities in power plants, petroleum plants, and the like.

In this case, if one computer is used to control the process amount, all functions will stop in the event of a failure, which may have a serious impact on the process side. Therefore, in order to solve this problem, a computer system using a plurality of computers has been considered, and these systems include (1) a system using a backup standby computer, and (2) a system using a dual configuration.

Here, the method (1) can be further divided into (i) online automatic switching and (ii) offline manual switching.

The offline manual switching method requires cable connections and manual switching to switch to a standby machine, so it is used when there is plenty of time. On the other hand, in the online automatic switching method, a standby machine is always on standby so that it can be brought online, and a failure of the computer during online operation is detected and the computer is automatically transferred to backup. In addition, the method (2) has a function in which at least two computers always perform the same calculation and check whether the data match.

However, method (1) above requires a spare machine and is therefore expensive, and method (2) improves data reliability but has the disadvantage of reducing the amount of processing. have.

The purpose of the present invention is to provide a multiple computer system that can improve information processing by having multiple online computers with similar functions perform mutual backups, rather than using spare machines. .

Hereinafter, one embodiment of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing a multi-computer system including two computers each consisting of an arithmetic control device, an auxiliary storage device, and a peripheral device control device. That is, the A-side system is composed of an arithmetic and control unit C1, an auxiliary storage device D1, and a peripheral device control device P1, and the B-side system is composed of an arithmetic and control device C2, an auxiliary storage device D2, and a peripheral device control device P2. . When both the A-side system and the B-side system are normal, the signal lines 11D, 11P and 22D, 22P are activated, the A-side system connects the A-side process 11A, and the B-side system connects the B-side process 11.
B are controlled independently.

Further, the signal lines 12D, 21D and 12P, 21P are mainly utilized in the event of a failure. On the other hand, a signal line 12C is provided so that data necessary for mutual backup between the A-side system and the B-side system can be exchanged during normal operation.

Further, the failure detection device 12CX has arithmetic control units Cl and C2.
This is to detect a failure in the system. This failure detection device 12C
When X detects a failure in either of the arithmetic and control units Cl or C2, it sends an interrupt signal to the healthy arithmetic and control unit to notify it of the failure, and also blocks the output of the failure side peripheral device control unit. In order to do so, the interlock circuit is notified. Figure 2 is a circuit diagram of the interlock circuit.
Figure 2a shows the interlock circuit 1LA of the A side system.
FIG. 2b shows the interlock circuit 1LB of the B-side system. The interlock circuit 1LA prevents the output of the peripheral device control device P1 and prevents erroneous output when the arithmetic and control device C1 fails. When the signal line 21P is activated and the backup operation by the arithmetic and control device C2 is started, This is to lift that block. If the peripheral device control device P1 fails during the backup operation by the arithmetic and control device C2, its output is blocked. Similarly, the interlock circuit ILB operates to prevent erroneous output from the peripheral device control device P2 when the arithmetic and control device C2 fails. That is, in FIG. 2a, Xll is the signal line 1
The signal 30C11 becomes "1" when 1P is active, and the signal 30C11 becomes "1" when the arithmetic and control unit C1 is normal.

Both these signals are applied to an AND circuit AND-A1.
Further, X2l is a signal that becomes 0F'' when the signal line 12P is active, and the signal line 12P is a signal that becomes 0F'' when the signal line 12P is active.
It is utilized by the arithmetic and control unit C1 in the event of a failure.
MO2 is an output signal from the peripheral device control device P2 when the peripheral device control device P1 is normal. This is a signal that becomes "0" when the arithmetic and control unit C1 fails and the line 21P is activated by the arithmetic and control unit C2, and when the peripheral device control unit P1 fails during a backup operation by the arithmetic and control unit C2. The signal X2l is applied to the OR circuit 0R-A1 via the NOT-A, and the output signal MO2
is also added to OR circuit 0R-A1 and this OR circuit 0R-A
The output of 1 is applied to the AND circuit AND-A1. Next, Xl2 is a signal that becomes "1" when the signal line 21P is active, and 30C12 is a signal that becomes "1" when the arithmetic and control unit C2 is normal.

Both signals Xl2 and 3OCl2 are applied to the AND circuit AND-A2 together with the output signal MO2. Then, the outputs of the AND circuits AND-Al and AND-A2 are connected to the OR circuit 0R-A.
2, its output can be taken out as an interlock signal 1La. In other words, the arithmetic and control unit Cl,
When both C2 are normal, Xll, 3OCll,
3OCl2 is "1", and X2l, Xl2 are "0". Furthermore, since no backup operation is performed during normal operation, MO2 is also "O". Therefore, AND-
The output of A1 is 611, and the output of AND-A2 is 1'
It becomes ゜. From this, the output of 0R-A2 becomes "1", and the output of interlock circuit IL1 becomes "1". Next, if the arithmetic and control unit C1 fails, 30
Since C11 becomes 10', the output of AND-A1 becomes "
0”.

On the other hand, immediately after the failure, the signal line 21P is not yet activated, so the output of AND-A2 is also "0". Therefore, the output of 0R-A2 becomes 0', and the output of the peripheral device control device P1 is blocked. When the backup operation by the arithmetic and control device C2 is started and the signal line 21P is activated, Xl2 becomes "1", and as long as the peripheral device control device P1 is normal, MO2 also becomes "1".

From this, the output of AND-A2 becomes "1",
The output of 0R-A2 also becomes ``1'', and the interlock is released.On the other hand, the interlock circuit 1LB of Fig. 2b
The same applies to

That is, in FIG. 2b, X22 is the signal line 22
30C12 is a signal that becomes "1F" when P is active, and 30C12 is a signal that becomes "1" when arithmetic and control unit C2 is normal. These two signals X22 and 3OCl2 are connected to an AND circuit.
Add to 1. In addition, Xl2 is a signal that becomes "1" when the signal line 21P is active, and MOl is an output signal from the peripheral device control device P1 when the peripheral device control device P2 is normal. In addition, the output signal MOl is added to the OR circuit 0R-B1 through the OR circuit 0R-B1.
-The output of B1 is added to the AND circuit AND-B1. Furthermore, X2l is a signal that becomes "F" when the signal line 12P is active, and 30C11 is a signal that becomes "1" when the arithmetic and control unit C1 is normal.
is applied to the AND circuit AND-B2 together with the output signal MOl. The outputs of the AND circuits AND-Bl and AND-B2 are added to the OR circuit 0R-B2 so that the output can be taken out as an interlock signal 1Lb. FIG. 3 is a circuit diagram of an output blocking circuit that blocks control output from peripheral device control device P1 by interlock signal 1La from interlock circuit 1LA.

If the process 11A is a plant process, this output blocking circuit is incorporated into the drive mechanism of the plant equipment. Now, assuming that the plant equipment is a control valve CV,
A signal for raising and lowering the control valve C is output from the peripheral equipment control device P1 as a control output. In this case, as shown in FIG. 3, the up signal and the interlock signal 1La are added to the AND circuit AND-A3, and the down signal and the interlock signal 1La are added to the AND circuit AND-A4. The outputs of AND-A3 and AND-A4 are applied to the peripheral control valve CV. Therefore, if the arithmetic control unit C1 or the peripheral device control unit P1 fails, the interlock signal 1 obtained from the interlock circuit ILA
When La becomes 0, the AND circuit AND-A3, AN
Since the output of D-A4 becomes "O", the control output to the control valve C is immediately cut off.

With this, the arithmetic control device C1 and the peripheral device control device P
It is possible to prevent erroneous outputs caused by a failure in item 1. Figure 4 shows the failure detection device 12CX when the arithmetic and control unit C1 fails.
and a time chart showing the operation of interlock circuit ILA.

That is, when the arithmetic and control unit C1 fails at time t1, the failure detection device 12XC detects this and notifies the interlock circuit 1LA. In the interlock circuit 1LA, when the arithmetic and control unit C1 fails, the signal 30C11 becomes 60''.
Therefore, the output La0 of interlock circuit 1LA
”. As a result, the output from the peripheral device control device P1 is blocked. On the other hand, an interrupt signal is sent from the failure detection device 12CX to the healthy arithmetic and control device C2.

When the arithmetic and control unit C2 receives this interrupt signal, it learns that a failure has occurred in the arithmetic and control unit C1 of the A-side system, and after confirming this, it issues a switching signal to activate the signal line 21P at the time T2. The peripheral device control device P1 is switched. As a result, the interlock signal 1La becomes 6F.
It becomes ゛ and becomes alive again. In this case, the control signal, ie, the output from the peripheral device control device P1, is interrupted between times t1 and T3. Next, the functions of the arithmetic and control units Cl and C2 will be explained. A control operation table as shown in FIG. 9, which will be described later, is stored in the auxiliary storage devices Dl and D2 of the present invention. In controlling the processes 11A and 11B, the arithmetic and control units Cl and C2 monitor the states of the processes 11A and 11B, select the most appropriate control operation table for that state, and Control is now performed according to the content. When starting the execution of the control, there are those that require operator permission as a condition and those that do not require operator permission as a condition. Now process 1
Assuming that 1A is a thermal power plant, its operating procedures can be roughly summarized as boiler ignition preparation, boiler ignition,
Control is generally performed through the following stages: boiler temperature and pressure increase, turbine ventilation preparation, turbine ventilation, turbine speed increase, and system integration.

Each stage of this operating procedure has multiple control operation items. For example, in the turbine ventilation preparation stage, there are items such as turpin reset, control valve warming, governor upper limit, low limiter upper limit, and drain valve fully open. be. In order to start executing various control operations within each stage, operator permission is usually not a condition.On the other hand, when performing control operations when moving from one stage to the next, , it is customary to require permission from the operator. That is, the control operations of the arithmetic and control units Cl and C2 are started in response to an operator's instruction if the operator's permission is required, and the process 11 is executed if the operator's permission is not a condition.
Execution is started depending on the states of A and 11B.

The conditions for starting execution of this operation are determined in advance based on the system configuration. Now, let us consider a case where the operator instructs to start an operation.

FIG. 5 is a time chart when the arithmetic and control unit C1 of the A-side system performs control operations. Assume that the state of the process 11A becomes such that a certain control operation should be performed as described above. For example, assume that the steam from the boiler is at a predetermined temperature and pressure, the turbine metal temperature satisfies a predetermined mismatch temperature, and there is no ventilation to the remaining turbine. This state is
Next, turbine ventilation is to be performed, and the arithmetic and control unit C1 selects the control operation table, but this turbine ventilation is conditional on the operator's permission, and the arithmetic and control unit C1 does not receive any instructions from the operator. The operation will not start until then. Therefore, when there is an instruction (a) from the operator, the arithmetic and control unit C1 executes the control operation, but prior to that, it transmits a command to start the control operation to the B-side system ( Time Ta) This transmission takes place via the signal line 12C. After transmitting the start command (input), data indicating the name of the control operation table (
C) is also transmitted via the signal line 12C (time Tb).
If the amount of data is large, signal line 12D is used. Simultaneously with the above command transmission, process control is started (time Tc). When the contents of the control operation table are completed, the operator's finger () is cut off, and the control (d) ends. The A-side system transmits this termination instruction (e) to the B-side system via the signal line 12C. The B-side system stores the contents of the start command (Vj) and data (c), and releases this memory after sending and receiving the end command ((1). In this way, when the arithmetic and control units Cl and C2 are normal, The basic operation is (a) Send control start and the name of the control operation table to the other party.

(b) Perform control according to the contents of the control operation table.

(c) When the contents of the control operation table have been executed and the control has ended, notify the other party of this. It is.

FIG. 6 shows a time chart when the A-side system fails during control execution, the B-side system enters its backup handover control operation, and the A-side system recovers from the failure during the backup handover control operation. It is.

Now, when the A-side system starts controlling at time Ta according to the operator's instruction (a), the operation start command (x) and the name of the control operation table are sent to the B-side system (c).

It is assumed that a failure occurs in the arithmetic and control unit C1 of the A-side system at time Ta while the A-side system is executing the processing of the control operation table (c). Then, the interlock circuit LA blocks the output of the peripheral device control device P1 (Figure 1). Thereafter, at time Te, the healthy arithmetic and control device C2 causes the peripheral device control device P1 to switch to the arithmetic and control device C2.
, and the backup handover control operation of the control operation table whose processing was interrupted is started in the A-side system (T). By the way, as described above, when selecting a control operation table, the computer of the present invention determines the state of the process and selects the control operation table to be processed in that state. However, in performing this backup handover control operation, the arithmetic and control unit C2 selects the name of the control operation table sent from side A in advance, without determining the status of the backup, and uses that control operation table. Process. This makes it possible to omit determining the state of the process 11A. Thus, the output from the peripheral device control device P1 is again output, and the B-side system backs up the A-side system. Here, at time Tf during this backup handover control, the arithmetic and control unit C of the A-side system
1 is recovered from the failure, A as shown in Figure 7a.
The side system waits until the backup handover control is completed. When it receives from the B-side system that the backup handover control has been completed (time Tg), the computer system is restored as shown in FIG. 7b. If A
If the system on the side does not recover from the failure, the system on the B side does not simply take over the processing of the control operation table whose processing was interrupted, but also takes over the subsequent control. In this case, while determining the state of process 11A of the A-side system,
Performs backup control after that. In the above explanation,
If there is a momentary interruption when transitioning to backup operation (
4 (between T and T3 in FIG. 4, and between Td and Te in FIG. 6), in order to eliminate this instantaneous interruption, a distributor S is provided as shown in FIG. 8.

That is, the process signals from the processes 11A and 11B are first input to the distributor S, and the signals are sent to the peripheral device controller P.
This is achieved by transmitting to both P1 and P2 at the same time. This distributor sends various process signals obtained from various sensors of the processes 11A and 11B to the peripheral equipment control device Pl.
, P2 simultaneously. In this case, even if the arithmetic and control device C1 fails, the arithmetic and control device C2
can take in the process signal of the process 11A via the distributor S, so it is possible to continue control from the signal line 22P without activating the signal line 21P.

In executing the control, the arithmetic and control unit C2 determines the state of the process 11A based on the process signal from the process 11A obtained via the distributor S, as shown in FIG. Identify control operation tables to be backed up. On the other hand, this control operation table is extracted from the auxiliary storage device D1 and inputted to the arithmetic and control unit C2 on the condition that the pickup signal is established. This pick-up signal is a start command,
It is output when the AND condition of the inverted signal of the termination command and the failure signal is satisfied. In addition, when the operation start command is set by the operator, if this start command is input to the arithmetic and control unit C2 via the distributor S, the A-side system can be Even if it breaks down, it can immediately go into backup.

Next, in Fig. 10, the A side system fails during control execution, and the B side system fails.
This is a time chart when the system on the A side performs specific backup handover control in response to a failure on the A side, and then backs up the control on the A side. In this case, as described below, data transmission (transmission of the name of the control operation table) becomes unnecessary. In other words, when the A-side system fails at time Td, the normal arithmetic and control unit C2
connects the peripheral device control device P1 to the arithmetic and control device C2 side, and when this is completed at time Te, the arithmetic and control device C2 performs specific backup handover control in response to a failure in the A-side system (Fig. What is backup handover control?
For example, when the target object is a turbine, this refers to holding the rotational speed of the turbine at the value at the time of failure or controlling it until it reaches a value within the safe range. Here, the reason why control is performed until the value in the safe area is reached is because there is a region called a critical speed region in the case of turbine rotation speed, and it is not desirable to hold it within that region while the turbine speed is increasing. be. After performing such specific backup handover control, the healthy arithmetic and control unit C2 determines the state of the process 11A, and performs backup control (QL)).

Therefore, in this embodiment, the A-side system does not take over the processing of the control operation table whose processing was interrupted.
Control data (name of control operation table) from the A-side system becomes unnecessary. Furthermore, in the above embodiment, when the system on the A side fails, the control of the system on the A side is backed up after performing specific backup handover control for the failure, but the control sampling period of the controlled object is determined by the process state. If the time is longer than the time required for the determination, the specific backup handover control may be omitted and the control of the A-side system may be suddenly backed up. In this case, after the arithmetic and control device C2 on the healthy side connects the peripheral device control device P1 on the failure side to the arithmetic and control device C2, it determines the state of the process 11A on the A side and selects a control operation table that matches the state. Then, a backup will be performed. In this case as well, transmission of control data is not necessary. On the other hand, the 10th
In the example shown in the figure, a case has been described in which a failure occurs in the A-side system and there is a momentary power outage before backup is performed in the B-side system, but the configuration shown in FIG. 8 can prevent such a momentary outage. Needless to say.

As described above, according to the present invention, a plurality of computers each including an arithmetic control device, an auxiliary storage device, and a peripheral device are connected to each other, and each device is provided with a means for mutually discovering a malfunction in the other side. By making it possible to switch the operation of the system, multiple systems, which would normally consist of one system at a time, can back up each other, reducing the need for additional functions.

Since mutual backup is performed by a plurality of online computers having similar functions instead of using a standby machine, it is possible to improve information processing at low cost. Furthermore, since the process control signal from the faulty side is interrupted, malfunctions caused by abnormal signals can be eliminated. On the other hand, the computer of the present invention executes control by selecting a control operation table suitable for the state according to a change in the state of the process, so the computer executes control as long as there is no change in the state of the process. There's no need.

Therefore, even if one computer fails and the other computer backs up the data, backup control only needs to be executed when the process status changes, so the computer load caused by backup is kept to a minimum. It can be kept to a minimum. In addition, the control that was being executed immediately before the failure is executed on another healthy computer, and the handover control is performed to match the control goal. Also, during the handover control, the failed computer retries, and the failure state is resolved. If it is not discovered, subsequent control is returned to the original computer, so in the case of important control where the sampling period of control performed by calculation must be shorter than the retry time in the event of a failure, it is important to ensure control safety. It becomes possible to secure it.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing one embodiment of the present invention, and FIG.
Figures A and b are circuit diagrams of interlock circuits corresponding to the A-side system and B-side system, and Figure 3 is a circuit diagram of an output blocking circuit for blocking control output from the peripheral device control device by the output of the interlock circuit. Fig. 4 is a time chart for explaining an example of the operation when the A-side system malfunctions, Fig. 5 is a time chart showing the operation when the A-side system is controlling normally, and Fig. 6 is the control of the A-side system. Time chart showing the operation when the A side system fails during the operation, No. 7
Figures A and b are from the backup state of the B-side system to A.
FIG. 8 is a block diagram showing another embodiment of the present invention, and FIG. 9 explains how to extract a control operation table when executing control in the same embodiment. FIG. 10 is a time chart of each signal in yet another embodiment of the present invention. Cl, C2... Arithmetic control unit, Dl, D2...
... Auxiliary storage device, Pl, P2 ... Peripheral device control device.

Claims (1)

[Claims] 1. An auxiliary storage device that stores a table that describes the contents of control operations for a process to be controlled, and determines the state of the process and selects and processes the table corresponding to the contents to be controlled in that state. A plurality of computers each consisting of an arithmetic and control device and a peripheral device control device for outputting the arithmetic results of the arithmetic and control device to the process as a control output are interconnected, and one of the arithmetic and control devices breaks down. a failure detection device that detects the failure and notifies a healthy arithmetic control unit of the failure; and an interlock circuit that blocks control output from the peripheral equipment control device of the failed computer when the failure detection device operates. and means provided in the arithmetic and control device for connecting the peripheral device control device of the failed computer to a healthy arithmetic and control device upon receiving a failure detection from the failure detection device and releasing the blocking of the control output. , installed in the arithmetic and control unit, performs handover control of the control operation that was being performed by the failed computer, and if the failure is not recovered, determines the state of the process that the failed computer was in charge of controlling; It is characterized by comprising means for backing up according to the state, and means for returning control to the recovered arithmetic and control device when the handover control in the healthy arithmetic and control device is completed when the failure is recovered. Multi-computer system.