JPH0346841B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a method for distributed control of a plant, and particularly to a method for controlling a plant in a distributed manner, in particular, without unnecessarily increasing the memory capacity of a plurality of distributed controllers, even if any one of the controllers fails, problems can be prevented. The present invention relates to a method that allows a plant to be controlled without any

Conventionally, for example, in a nuclear power plant control system, as the number of control objects increases, it is dangerous to control them with a single plant controller, so multiple plant controllers are used to control them in a decentralized manner. It has come to control the controlled object. In this kind of distributed control, if any plant controller fails, the remaining normal plant controllers take over the function, but in the past, However, the control system itself is uneconomical, the connection between the controllers is complicated, and the memory capacity for storing the control program in each controller must be unnecessarily increased. There is.

That is, in the past, from the perspective of achieving high control reliability, control systems were generally configured as redundant systems such as a duplex system or 2 out of 3 system, or as a backup system such as an 8-to-1 backup system. It is. However, when configured as a redundant system, it cannot be denied that the system configuration becomes uneconomical. In addition, when configured as a backup system, not only does the connection with the backup controller become complicated, but the backup controller also needs to perform all the functions of other controllers, so it is necessary to store the control program. The disadvantage is that the memory capacity must be increased as the number of controllers and controlled objects increases.

For this reason, control systems are being considered that are not configured as a redundant system or a backup system, but instead have a plurality of controllers in which if one of the controllers fails, another controller executes its function in its place. Although multiple controllers back up each other, such control systems are not without problems. This is because, in order to back up each other, each controller must also contain a control program to be executed by the other controller in order to execute all the functions of the other controller. In normal times, each controller does not execute any control programs that other controllers execute, but when another controller fails, that controller takes over and executes the control program that should be executed. It is something. Therefore, a controller in such a control system must have a large memory capacity, and distributed control cannot be carried out economically.

Therefore, it is an object of the present invention to simplify the system configuration without unnecessarily increasing the memory capacity of each distributed control controller, so that even if one of the controllers fails, the plant can be operated without any particular trouble. The object of the present invention is to provide a plant distributed control method that can economically control the plant.

For this purpose, the present invention provides that the control program that each controller should originally execute consists of various control program parts, and that the importance of these control program parts is generally not the same, and that less important parts may not be executed for the time being. This was done by focusing on the fact that it does not cause any problems. That is,
Each controller is preloaded with at least the control program that it is supposed to execute, and whenever one of the controllers breaks down, a predetermined controller takes over and executes the functions of that controller. The control program is reorganized into control program parts with high importance, and the control program related to the reorganization is executed. When reorganizing the control program, the controller receives the more important control program part from the faulty controller via the higher-level computer and executes it in place of the less important control program part that it should have originally executed. .

The present invention will be explained below with reference to FIGS. 1 to 4.

First, FIG. 1 shows the system configuration of an example of a plant distributed control system according to the present invention.

As shown in the figure, three controllers A, B, and C for distributed control are indirectly connected via a bus line 2 under the control of a host computer 1, and normally each controller A, B, and C is assigned to itself. While inputting the detection output from the detector,
The operating device is controlled by appropriately processing the detection output. Code 10A,1
0B, 10C are detectors, and codes 11A, 11
Although B and 11C indicate operating devices, it goes without saying that each controller A, B, and C actually accommodates a plurality of various detectors and operating devices. By the way, each controller A, B, and C are configured identically. To explain the configuration of controller A, it consists of a CPU section 3A, memory sections 6A and 7A, process input/output section 8A, communication section 4A, program reorganization section 5A, and switching section 9A. The situation is similar. Of the memory sections 6A and 7A, the memory section 6A is used to store control programs, and the memory section 7A is used to store the operating system (OS) and basic control subroutines (proportional, integral, differential control, limiters, etc.). However, what should be noted here is the type of control program stored in the memory section 6A. Memory section 6A
It goes without saying that the control program that should originally be executed by controller A is stored in the controller A, but in some cases, highly important control programs that should originally be executed by either controller B or C are also stored. It is. This is because if all of the control programs that controllers B and C should originally execute are stored, there is no difference from the prior art in terms of memory capacity. However, basically, only the control program that should be executed by itself is necessary and sufficient. Memory section 6B in controllers B and C,
The situation is exactly the same for the control program stored in 6C.

Now, suppose that if controller A fails, controller B will perform the respective functions, if controller B fails, controller C will perform the respective functions, and if controller C fails, controller A will perform the respective functions. Memory section 6A, 6
At least controllers A, B, and C are installed in B and 6C.
Control programs that should originally be executed by controllers C, A, and B are stored in the memory sections 6A, 6B, and 6C in some cases. It is. During normal times, each controller A,
B and F accommodate their own assigned detectors and operating devices via the switching section and process input/output section, and perform distributed control over the entire plant by executing the control programs that they should originally execute. However, if any of the controllers A, B, or C fails in such a state, the controller adjacent to the failed controller will take over the function.

For example, if controller A malfunctions, the malfunction is detected by a watchdog timer or the like, which controls switching of switching section 9A and relay signal line 11 of detector 10A and operation device 11A.
This is where it will be connected to 2AB and 12BA. On the other hand, the fact that the controller A has failed is communicated to the communication unit 4A via the bus line 2 to the host computer 1, and then from the host computer 1 to the bus line 2.
The information will be reported to controller B via , and controller B will take necessary measures. That is, the controller B immediately controls the switching section 9B to accommodate the detector 10A and the operating device 11A, and reorganizes the control program. In this case, the reorganization is performed by the program reorganization unit 5B, but it is not necessary to check whether the memory unit 6B stores all of the control programs that should originally be executed by the controller A or the most important control program portions thereof. The mode of organization differs slightly depending on the type. If stored in the memory unit 6B, controllers A and B extract and reorganize the highly important control program portions from the control programs that should originally be executed, so that controller B executes the control programs related to the reorganization. However, if it is not stored, the reorganization will be performed after receiving the control program portion with higher importance from the controller A under the intervening transfer control by the host computer 1.

Even if controllers B and C fail, controllers C and A, respectively, will take over and execute the functions of controllers B and A related to the failure, in the same manner as in the above case. According to the present invention, even if all but one controller fails, the plant can be controlled without any particular trouble. For example, in FIG. 1, if controllers A and B fail, controller C takes over the functions of controllers A and B. In the switching section of the faulty controller, the detectors and operating devices that were previously housed are accommodated and connected to the relay signal lines on both sides, while the normal controller performs control that is more important than the faulty controller as necessary. This is because it is sufficient to receive the program portions and reorganize the control program. Although the content of the present invention has been schematically described for the case where there are three controllers, the present invention is generally applicable to a plant distributed control system having two or more controllers. However, the switching units in each controller must be arranged in a loop via relay signal lines.

Although the present invention is as described above, the present invention will be explained in more detail assuming the most basic case below. Assuming that each controller has only the control program that it is supposed to execute in its memory, if one of the controllers fails, the adjacent controller will not, in principle, be able to take over and execute that function. As already mentioned, FIG. 2 shows how the storage state of the control program in the memory section of the controller that takes over the function of the failed controller changes. That is, FIG. 2a shows it before the failure, and FIG. 2b shows it after the failure.
As shown in the figure, in this example, the memory section 6 is 1000 in hexadecimal notation.
The memory area is divided into six equal parts, and the control program part is stored in a length of 256 bytes. A 1-byte long label for specifying a control program portion is stored at the start address of each memory area, and the control program is reorganized as described later using this label. In this example, the upper 3 bits that make up the label indicate the controller-specific program name, the lower 2 bits indicate the important part of the control program, and the middle 3 bits indicate the execution order of the control program. It's getting old. Therefore, for example, if the label is "00101011", that label can be displayed as (123) by dividing the bit interval as described above, and from this, the control program part to which this label is attached has no function. It constitutes a part of the control program of the controller that is executed instead, has an importance level of 3, and is known to be executed second. However, in this example, the smaller the value, the more important the importance is.

The manner in which the control program portion is stored in the memory unit 6 during normal times is as shown in FIG. 2a.
When an adjacent controller fails, the controller receives control program parts that are more important than that controller, and stores those control program parts in a predetermined order in the memory area where its own less important control program parts are stored. be. The control program parts (210), (231), and (241) in Figure 2b are of course from the faulty controller, and the program name unique to the faulty controller is displayed as "2". It is something that exists. The controller that executes the functions takes over the control programs related to the reorganization, such as (110), (130), (151), (210), (231), (2
41)
By sequentially executing the above steps, the functions of the controller related to the failure can be executed in place of the controller. When backing up the functions of a failed controller in this way, even if less important parts of the control program are no longer executed, more important parts can still be executed despite the failure of the controller. No major problems will arise for the time being.

By the way, when reorganizing a control program as described above or executing a control program related to reorganization, it is necessary to search for a control program part of low importance and display its start address, or to search for a control program part of low importance and display the start address of a control program part of high importance from a controller related to a failure. Consideration must be given to storing the control program portion smoothly and quickly in the memory unit, and generating and displaying the start address corresponding to the control program portion to be executed. The program reorganization section was prepared to facilitate these operations.

FIG. 3 shows the configuration of the program reorganization section. As already mentioned, if any controller malfunctions, that fact is reported to the CPU unit via the communication unit, bus line, etc., and further via the communication unit of the controller that takes over the function of that controller. Accordingly, the CPU section activates the program reorganization section 5 via the bus line inside the controller. When the program reorganization section 5 is activated, its control circuit 5b first sets a value of low importance in the label input register 5d. In the example shown in FIGS. 2a and 2b, the value "3" is first set.
Hereinafter, referring to the example shown in FIG. 123) and (163) are flagged to indicate a match. The matching register 5g consists of bits corresponding to labels, and a flag is set at the bit position corresponding to the label with the same degree of importance. By updating the importance value in the label input register 5d within an appropriate range, the verification register 5g
By setting flags one after another, control program parts with low importance can be detected, and based on the flag information, the start addresses of these control program parts are generated by the real address generation circuit 5h and stored in the address register 5i in a predetermined order. It is something that has become popular. On the other hand, the control program parts with high importance from the controller related to the failure are output from the communication unit to the bus line in order of importance.
After being input via the communication unit to the controller that directly or indirectly executes the function, it is temporarily stored in the buffer register 5a of the program reorganization unit 5. However, the DMA control circuit 5
If the control program part is DMA-transferred from the buffer memory 5a to the memory section based on the start address stored in the address register 5i, the memory area where the control program part of low importance was previously stored will be Control program parts of high importance from a controller related to a failure are stored in a predetermined order.

When the storage of the control program portion in the memory section is completed, the reorganization of the control program is also completed, but after this, the controller executes the control program related to the reorganization. In this execution, the execution order of the control program part is from address 1000 to 15FF
They are not necessarily executed in order toward the addresses. In the example shown in FIG. 2b already described, the control program portions are executed in the order of the numbers displayed in the circles, but such control of the execution order is performed as follows. That is, the CPU section first sends (11X) to the program reorganization section 5 when executing the control program. However, the value of X indicating the degree of importance may be any value in this case. (11X) is input to the control circuit 5b via the DMA control circuit 5c, is set in the label input register 5d, and is compared with the contents of the content addressable memory 5f via the mask register 5e, ignoring the importance level. be. When the control program is executed, the contents stored in the associative memory 5f are as shown in FIG. A flag is placed at the location. Therefore, the actual start address of the control program portion to be executed from the bit position number Y where the flag is set can be determined in hexadecimal notation as follows.

Real start address = $1000 + $100 x (bit position number Y) The real start address is obtained by the real address generation circuit 5h, and this is the address register 5.
i. The CPU section first executes the control program portion corresponding to the label (110) by being sent to the CPU section via the control circuit 5b. After this execution is completed, the CPU section will send the label (12X) to the program reorganization section 5, but in this case, the flag will not be raised, so we received a report to that effect.
The CPU section then sends a label (13X). If a flag is set for a label sent in this way, the control program part corresponding to that label is executed, and if the control program part is finished running or the flag is not set, the execution order is updated. The label is sent to the program reorganization section 5. After the CPU section sends the label (16X), the labels (21X), (22X),
By sequentially sending (23X), (24X), (25X), and (26X), the control program portions can be executed in a predetermined order as described above. In addition,
Use normal memory instead of associative memory 5f,
Although it is possible to write a label on it, read it out sequentially, and compare it with a collation label, it takes a lot of time to process.

The present invention has been described above regarding the most basic case, but if the controller that takes over the function of the failed controller has a control program for the failed controller in its memory section, the switching unit Of course, it is possible to back up immediately after controlling the switching. If the controller that is backing up the failed controller fails again, another controller that is operating normally will obtain the control program portion of that controller and further reorganize the control program. be.

In general, distributed control is more efficient when a controller contains control programs for other controllers, but on the other hand, an increase in memory capacity is inevitable. However, if each controller is provided with the minimum necessary control program in advance, the memory capacity will not be increased unnecessarily, and even if a failure occurs in one of the controllers, it will not affect the functionality of the entire plant. This makes it possible to perform more distributed control than the necessary minimum without giving any problems. In the distributed control system to which the present invention is applied, the control function will not be lost unless all controllers fail at the same time, and it is possible to repair the failed controller without stopping the plant. For example, it is extremely effective for plants that require high reliability and high safety, such as nuclear power plants.
It will also be economically viable.

As explained above, the present invention allows each controller to store only the control program that it should originally execute, and whenever one of the controllers malfunctions, a predetermined controller executes a control program that is more important than the controller involved in the malfunction. After receiving the program part, the control program is reorganized from the highly important control program part that should be executed by the faulty controller and the highly important control program part that should be executed by itself, and the reorganized control program is It was designed to be executed. Therefore, according to the present invention, it is possible to economically control the plant without unnecessarily increasing the memory capacity of each controller, and without causing any particular trouble even if any of the controllers breaks down. There is an effect.

[Brief explanation of drawings]

FIG. 1 is a diagram showing a system configuration of an example of a plant distributed control system according to the present invention, and FIGS. 2 a and 2 b show an example of the storage state of a control program in the memory section after its storage state has been reorganized. 3 is a diagram showing the configuration of a part of the program reorganization unit in FIG. 1, and FIG. 4 is a diagram showing the operation centered on the associative memory when the reorganized control program is executed. It is an explanatory diagram. 2...Bus line, 3A-3C...CPU section,
5A~5C, 5...Program reorganization department, 6A~
6C, 6...Memory section (for storing control programs), 8A-8C...Process input/output section, 9A-9
C...Switching unit, 10A to 10C...Detector, 11
A~11C...Operator.

Claims (1)

[Claims] 1. In a system in which multiple controllers are indirectly connected to each other via an external common bus line under the control of a host computer and perform distributed control over a plant, each controller is given only the control program that it is supposed to execute. The controller is stored in advance, and each time a controller fails, the controlled object and detector that were connected and housed in that controller are connected and housed in a predetermined controller, while the specified controller is connected to and housed in a predetermined controller. Receives a control program part that is more important than the controller, and reorganizes a new control program from the highly important control program part that should be executed by the failed controller and the highly important control program part that should be executed by itself. 1. A plant distributed control method characterized in that the plant decentralized control method is further executed.