Processing method for controlling program exception

Abstract

The invention relates to a control program exception processing method, which is applied to a 1: 1 hot standby redundant controller architecture, and comprises the following steps: a software engine performs exception event detection on a control program according to an internally registered exception event to obtain an exception detection result; when the result of the exception detection is that an exception occurs, the software engine marks the control program with the exception as an exception, and rejects the control program from a normal working process; the software engine sends abnormal information to the abnormal program monitoring service, the abnormal program monitoring service receives the abnormal information and sends the abnormal information to the control program state publishing service, and the control program state publishing service receives the abnormal information and stores and displays the abnormal information; and the software engine sends a redundancy switching instruction to the central control equipment, so that the central control equipment transfers the control right to the standby controller. According to the method, the technical problem that when the program is abnormal, processing cannot be carried out in time can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial automation, and in particular to a method for processing control program exceptions. Background Art

[0002] In the process of process industry and discrete industry automation production, the control program running in the controller determines the degree of automation and reliability of production. When a program in the controller has an exception such as division by 0, array out-of-bounds access, memory out-of-bounds access, null pointer access, or dead loop, if the exception is not handled, the entire controller will fail. The failure may cause system shutdown, production interruption, product quality failure, and even vicious production accidents, endangering the safety of life and property of personnel. The direct economic losses caused are very huge, and the indirect losses and social impacts are even more difficult to estimate.

[0003] When the above faults occur, factory operators can temporarily intervene by conducting 24-hour patrols to discover and restart the controller, but the work intensity is high and the abnormal recovery time is long.

[0004] Therefore, a method for processing control program exceptions is urgently needed. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides a method for handling control program anomalies, which solves the technical problem that in the process of process industry and discrete industrial automation production, when an abnormality occurs in the control program in the controller, it cannot be handled in time, resulting in huge economic losses, and the indirect losses and equipment impacts are even more difficult to estimate.

[0007] (II) Technical solution

[0008] In order to achieve the above object, the main technical solutions adopted by the present invention include:

[0009] An embodiment of the present invention provides a method for processing a control program exception, which is applied to a 1:1 hot standby redundant controller architecture, including:

[0010] S100, the software engine performs abnormal event detection on the control program according to the internally registered abnormal events, and obtains the abnormal event detection result;

[0011] S200, when the result of the anomaly detection is that an anomaly occurs, the software engine marks the control program in which the anomaly occurs as an anomaly, and removes it from the normal workflow;

[0012] The software engine sends the abnormal information to the abnormal program monitoring service, the abnormal program monitoring service receives the abnormal information and sends the abnormal information to the control program status publishing service, the control program status publishing service receives the abnormal information, and performs statistics, storage and display on the abnormal information;

[0013] S300: The software engine sends a redundant switching instruction to the central control device, so that the central control device transfers the control right to the standby controller.

[0014] Optionally, the 1:1 hot standby redundant controller architecture includes:

[0015] Central control equipment, two controllers with 1:1 hot standby redundancy;

[0016] The central control device is respectively connected to the two controllers with 1:1 hot standby redundancy.

[0017] Optionally, the two controllers with 1:1 hot standby redundancy are dedicated hardware controllers or cloud controllers based on a virtualized cloud environment of a PC server.

[0018] Optionally, the two controllers of the 1:1 hot standby redundancy respectively include: an application layer, a scheduling layer, and a platform layer;

[0019] The platform layer includes Windows / Linux+real-time patch;

[0020] The scheduling layer is a control program based on ICE61131-3, including a control program scheduling service;

[0021] The application layer includes abnormal program monitoring service and control program status publishing service.

[0022] Optionally, before S100, the step further includes:

[0023] S000, software engine registration abnormal event;

[0024] The S000 specifically includes:

[0025] S010, the software engine receives information about abnormal situations input by a user, and randomly generates a unique event identifier for each abnormal situation according to the information about the abnormal situation;

[0026] S020. The software engine receives the abnormal situation solution input by the user, and generates a processing program corresponding to each abnormal situation according to the abnormal situation solution. The processing program is called when the abnormal situation occurs.

[0027] Optionally, the abnormal event includes:

[0028] Integer and floating point division by zero, array out-of-bounds access, memory out-of-bounds access, and null pointer access.

[0029] Optionally, the method further comprises:

[0030] The software engine obtains the running time of each control program, and determines whether the running time of the control program exceeds the expiration time according to a preset expiration time. If it exceeds, steps S200 to S300 are executed.

[0031] Optionally, the software engine obtains the running time of each control program including:

[0032] After sending the first instruction to the control program scheduling service, the software engine receives the start execution time and the end execution time of each control program fed back by the control program scheduling service; the software engine obtains the running time of each control program according to the start execution time and the end execution time of each control program;

[0033] The first instruction is to obtain the start execution time and the end execution time of each control program.

[0034] Optionally, the method further comprises:

[0035] S400, the central control device receives a redundant switching instruction, and performs a status check on the standby controller according to the redundant switching instruction;

[0036] S500: When the status of the standby controller is normal, the central control device initializes and configures the standby controller and then transfers the control right to the standby controller.

[0037] Optionally, the method further comprises:

[0038] S600: The central control device restarts the controller with the abnormal control program, and restores the state of the control program in the controller with the abnormal program to the state before the abnormality, and incorporates it into the normal control process.

[0039] (III) Beneficial effects

[0040] The beneficial effects of the present invention are: a method for handling control program exceptions of the present invention automatically captures the exception in the first time when an exception occurs in the program, notifies the monitoring of the name of the abnormal program, and immediately initiates redundant switching, and then eliminates the abnormal program and hot resets the controller. Compared with the prior art, it can achieve high real-time exception recovery in milliseconds, ensuring that the controller continues to operate with high reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a method for processing a control program exception according to an embodiment of the present invention;

[0042] Figure 2 A schematic diagram of a 1:1 hot standby redundant controller architecture according to Embodiment 2 of the present invention;

[0043] Figure 3 A schematic diagram of a hierarchical architecture of each controller in a 1:1 hot standby redundant controller architecture according to Embodiment 2 of the present invention;

[0044] Figure 4 A processing sequence diagram of a method for processing a control program exception according to Embodiment 2 of the present invention;

[0045] Figure 5 The figure is a timing diagram of processing a dead loop exception in a method for processing a control program exception in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0046] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below through specific implementation modes in conjunction with the accompanying drawings.

[0047] Hardware controller: An embedded device that can run control logic programs. In the field of industrial automation, there are usually two types: DCS and PLC.

[0048] Cloud controller: Its functions are the same as those of a hardware controller, but its deployment method is no longer based on dedicated hardware, but on a general-purpose PC server.

[0049] IEC61131-3: The third part of the industrial automation and control system standard issued by the International Electrotechnical Commission (IEC), which is specifically aimed at the standardization of programmable logic controller (PLC) programming languages. The standard defines five programming languages: Ladder Diagram (LD), Function Block Diagram (FBD), Sequential Function Chart (SFC), Structured Text (ST), and Instruction List (IL).

[0050] FBD: Function Block Diagram (FBD) is a graphical programming language that complies with the IEC61131-3 standard. It describes control logic by connecting various function blocks (such as logical operations, comparisons, mathematical operations, etc.). It is one of the most important control strategy programming languages ​​in the field of industrial control.

[0051] A method for handling control program exceptions proposed in an embodiment of the present invention is to solve the technical problem that in process industry and discrete industrial automation production processes, when a control program in a controller has an exception, it cannot be handled in time, resulting in huge economic losses, and indirect losses and equipment impacts are even more difficult to estimate. The present invention registers exception events on the software engine of the controller. When an exception occurs in the program, the exception can be automatically captured at the first time, and redundant switching occurs immediately, thereby achieving high real-time fault recovery in milliseconds, which can ensure that the controller continues to operate with high reliability.

[0052] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0053] Specific embodiment description part

[0054] Example 1

[0055] See also Figure 1 A method for processing a control program exception according to an embodiment of the present invention is applied to a controller architecture with 1:1 hot standby redundancy. The method comprises:

[0056] S100, the software engine performs abnormal event detection on the control program according to the internally registered abnormal events, and obtains the abnormal event detection result;

[0057] S200, when the result of the anomaly detection is that an anomaly occurs, the software engine marks the control program in which the anomaly occurs as an anomaly, and removes it from the normal workflow;

[0058] The software engine sends the abnormal information to the abnormal program monitoring service, the abnormal program monitoring service receives the abnormal information and sends the abnormal information to the control program status publishing service, the control program status publishing service receives the abnormal information, and performs statistics, storage and display on the abnormal information;

[0059] S300: The software engine sends a redundant switching instruction to the central control device, so that the central control device transfers the control right to the standby controller.

[0060] The present invention is applicable to a 1:1 hot standby redundant controller architecture and is used in process industry and discrete industry automation production.

[0061] A method for handling control program exceptions in the present embodiment can automatically capture the exception in the first time when the program exception occurs, notify the monitoring of the information of the abnormal program, and immediately initiate redundant switching, and achieve millisecond-level high-real-time fault recovery by eliminating the abnormal program and hot-resetting the controller, thereby ensuring that the controller architecture continues to operate with high reliability. In addition, the staff can quickly issue abnormal program alarms and quickly locate the abnormal control program through the fault information published by the control program status publishing service, so as to intervene and handle it in the first time to ensure the reliability of the controller architecture.

[0062] Example 2

[0063] See also Figure 4 A method for processing a control program exception in this embodiment is applied to a 1:1 hot standby redundant controller architecture, and the processing method includes:

[0064] Step S100: The software engine performs abnormal event detection on the control program according to the internally registered abnormal events, and obtains the abnormal event detection result;

[0065] Step S200: When the result of the abnormality detection is that an abnormality occurs, the software engine marks the abnormal control program as abnormal and removes it from the normal workflow;

[0066] The software engine sends the abnormal information to the abnormal program monitoring service, which receives the abnormal information and sends it to the control program status publishing service, which receives the abnormal information, stores the abnormal information in statistics and displays it;

[0067] Step S300: The software engine sends a redundancy switching instruction to the central control device, so that the central control device transfers the control right to the standby controller.

[0068] The abnormal information is the name of the control program where the abnormality occurred.

[0069] The present invention is applicable to a 1:1 hot standby redundant controller architecture, and can ensure millisecond-level recovery when an abnormality occurs.

[0070] In this embodiment, the control program status publishing service receives information about the abnormality, and stores and displays the information about the abnormality. At this time, the operation and maintenance personnel can view the abnormal information through the web page, so as to quickly locate the control program with the abnormality, and then completely repair the abnormality by modifying the control program.

[0071] In this embodiment, see Figure 2 , the 1:1 hot standby redundant controller architecture includes:

[0072] Central control equipment, two controllers with 1:1 hot standby redundancy;

[0073] The central control device is respectively connected to the two controllers with 1:1 hot standby redundancy for communication.

[0074] The two controllers with 1:1 hot standby redundancy are dedicated hardware controllers or cloud controllers based on a virtualized cloud environment of a PC server.

[0075] See also Figure 3 ,The two controllers with 1:1 hot standby redundancy include: application layer, scheduling layer, and platform layer;

[0076] The platform layer includes Windows / Linux+real-time patches;

[0077] The scheduling layer is a control program based on ICE61131-3, including control program scheduling services;

[0078] The application layer includes abnormal program monitoring services and control program status publishing services.

[0079] In the specific implementation process, a control program exception processing method of the present invention supports running on a hardware controller and can also be deployed in a virtualized cloud environment based on a PC server. The real-time service can schedule control programs written based on ICE61131-3, including LD, FBD, SFC, ST, and also function blocks written in high-level languages ​​such as C++ and python. The standard web page can view the running status and abnormal conditions of each control program through the "control program status publishing service".

[0080] In this embodiment, before step S100, the following steps are also included:

[0081] Step S000, the software engine registers an abnormal event;

[0082] Step S000 specifically includes:

[0083] Step S010: the software engine receives the abnormal situation information input by the user, and randomly generates a unique event identifier for each abnormal situation according to the abnormal situation information;

[0084] Step S020: The software engine receives the abnormal situation solution input by the user, and generates a processing program corresponding to each abnormal situation according to the abnormal situation solution. The processing program is called when the abnormal situation occurs.

[0085] For example, the abnormal situation information input by the user is "the control program tries to open a file that has not been created yet", and the software engine generates a unique event identifier "array out-of-bounds access" based on the information;

[0086] For the exception solution of "the control program tries to open a file that has not been created yet", the user enters "check whether the requested index is within the valid range of the file list". At this time, the software engine generates a handler corresponding to "array out-of-bounds access" based on the exception solution.

[0087] When performing anomaly detection, when the "control program attempts to open a file that has not been created yet" occurs, the software engine calls "check whether the requested index is within the valid range of the file list" to perform detection and obtain the result of the anomaly detection.

[0088] In this embodiment, abnormal events include:

[0089] Integer and floating point division by zero, array out-of-bounds access, memory out-of-bounds access, and null pointer access.

[0090] In this embodiment, see Figure 5 , the method for handling control program exceptions also includes:

[0091] The software engine obtains the running time of each control program, and determines whether the running time of the control program exceeds the expiration time according to a preset expiration time. If it exceeds, step S200 to step S300 are executed.

[0092] The software engine obtains the running time of each control program including:

[0093] After sending the first instruction to the control program scheduling service, the software engine receives the start execution time and the end execution time of each control program fed back by the control program scheduling service; the software engine obtains the running time of each control program according to the start execution time and the end execution time of each control program;

[0094] The first instruction is to obtain the start execution time and the end execution time of each control program.

[0095] In the specific implementation process, when the running time of the control program exceeds the timeout period, the corresponding exception is an infinite loop exception.

[0096] The time-out period is determined based on the performance criteria of the control program.

[0097] In this embodiment, the control program scheduling service obtains the start execution time and the end execution time of each control program through an internal timer.

[0098] The control program exception handling method also includes:

[0099] Step S400: The central control device receives a redundant switching instruction, and performs a status check on the standby controller according to the redundant switching instruction;

[0100] Step S500: When the status of the standby controller is normal, the central control device initializes and configures the standby controller and then transfers the control right to the standby controller.

[0101] For example, when the control program encounters an "array out-of-bounds access" exception, the software engine immediately sends a redundant switching instruction to the central control device, instructing the central control device to switch to the backup controller. After receiving the redundant switching instruction, the central control device begins to check the status of the backup controller; the status check includes:

[0102] Hardware health check: Make sure the CPU, memory, I / O modules and other hardware devices of the standby controller are running normally;

[0103] Software status check: confirm that the operating system, application programs, and control programs of the standby controller are functioning normally;

[0104] Data synchronization status check: Ensure that the data of the standby controller is consistent with the controller before the abnormality occurs.

[0105] When the status of the standby controller is normal, the central control device initializes and configures it to ensure that it can seamlessly take over the control tasks.

[0106] Initial configuration of the standby controller includes:

[0107] Load the latest configuration file to ensure that the standby controller has the latest production parameter configuration; synchronize the latest data of the controller before the abnormality occurred to the standby controller; set network communication parameters to ensure that the standby controller can communicate with other devices correctly, such as updating the IP address and port number.

[0108] In the specific implementation process, through the above steps, the standby controller can quickly take over the control task, reducing downtime and production losses.

[0109] The control program exception handling method also includes:

[0110] Step S600: The central control device restarts the controller with the abnormal control program, and restores the state of the control program in the controller with the abnormal program to the state before the abnormality, and incorporates it into the normal control process.

[0111] In the specific implementation process, the software engine that executes the method of this embodiment is the software engine of the main controller; when an abnormality occurs in the main controller, the backup controller enters the working process, and the software engine of the backup controller executes the method of this embodiment.

[0112] A method for handling control program exceptions in this embodiment is applicable to dedicated hardware controllers based on operating systems and cloud controllers on PC servers in the production process of process industry and discrete industrial automation. It can capture exceptions in the first time, notify the abnormal program monitoring service of the abnormal information, and immediately initiate redundant switching, and then realize millisecond-level high-real-time fault recovery by proposing abnormal programs and hot-resetting controllers, ensuring that the controller continues to operate with high reliability, and the working operator can promptly report the alarm and intervene in the first time; the factory operation and maintenance personnel can very conveniently view the abnormal control program through the web page, and thus completely repair the abnormality by modifying the control program.

[0113] In the description of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0114] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0115] In the present invention, unless otherwise clearly specified and limited, when a first feature is “on” or “below” a second feature, it may be that the first and second features are in direct contact, or that the first and second features are in indirect contact through an intermediate medium. Moreover, when a first feature is “above”, “above” or “above” a second feature, it may be that the first feature is directly above or obliquely above the second feature, or it may simply mean that the first feature is higher in level than the second feature. When a first feature is “below”, “below” or “below” a second feature, it may be that the first feature is directly below or obliquely below the second feature, or it may simply mean that the first feature is lower in level than the second feature.

[0116] In the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0117] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may alter, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A method for processing a control program exception, characterized in that: Applied to a 1:1 hot standby redundant controller architecture, the processing method includes: S100, the software engine performs abnormal event detection on the control program according to the internally registered abnormal events, and obtains the abnormal event detection result; S200, when the result of the anomaly detection is that an anomaly occurs, the software engine marks the control program in which the anomaly occurs as an anomaly, and removes it from the normal workflow; The software engine sends the abnormal information to the abnormal program monitoring service, the abnormal program monitoring service receives the abnormal information and sends the abnormal information to the control program status publishing service, the control program status publishing service receives the abnormal information, and performs statistics, storage and display on the abnormal information; S300: The software engine sends a redundant switching instruction to the central control device, so that the central control device transfers the control right to the standby controller.

2. The method for handling control program abnormality according to claim 1, characterized in that: The 1:1 hot standby redundant controller architecture includes: Central control equipment, two controllers with 1:1 hot standby redundancy; The central control device is respectively connected to the two controllers with 1:1 hot standby redundancy.

3. The method for handling control program abnormality according to claim 2, characterized in that: The two controllers with 1:1 hot standby redundancy are dedicated hardware controllers or cloud controllers based on a virtualized cloud environment of a PC server.

4. The method for processing controller program abnormality according to claim 3, characterized in that: The two controllers of the 1:1 hot standby redundancy respectively include: an application layer, a scheduling layer, and a platform layer; The platform layer includes Windows / Linux+real-time patch; The scheduling layer is a control program based on ICE61131-3, including a control program scheduling service; The application layer includes abnormal program monitoring service and control program status publishing service.

5. The method for handling control program abnormality according to claim 1, characterized in that: The S100 also includes: S000, software engine registration abnormal event; The S000 specifically includes: S010, the software engine receives information about abnormal situations input by a user, and randomly generates a unique event identifier for each abnormal situation according to the information about the abnormal situation; S020. The software engine receives the abnormal situation solution input by the user, and generates a processing program corresponding to each abnormal situation according to the abnormal situation solution. The processing program is called when the abnormal situation occurs.

6. The method for handling control program abnormality according to claim 1, characterized in that: The abnormal events include: Integer and floating point division by zero, array out-of-bounds access, memory out-of-bounds access, and null pointer access.

7. The method for handling control program abnormality according to claim 1, characterized in that: The method further comprises: The software engine obtains the running time of each control program, and determines whether the running time of the control program exceeds the expiration time according to a preset expiration time. If it exceeds, steps S200 to S300 are executed.

8. The method for handling control program abnormality according to claim 7, characterized in that: The software engine obtains the running time of each control program including: After sending the first instruction to the control program scheduling service, the software engine receives the start execution time and the end execution time of each control program fed back by the control program scheduling service; the software engine obtains the running time of each control program according to the start execution time and the end execution time of each control program; The first instruction is to obtain the start execution time and the end execution time of each control program.

9. The method for handling control program abnormality according to claim 1, characterized in that: The method further comprises: S400, the central control device receives a redundant switching instruction, and performs a status check on the standby controller according to the redundant switching instruction; S500: When the status of the standby controller is normal, the central control device initializes and configures the standby controller and then transfers the control right to the standby controller.

10. The method for handling control program abnormality according to claim 9, characterized in that: The method further comprises: S600: The central control device restarts the controller with the abnormal control program, and restores the state of the control program in the controller with the abnormal program to the state before the abnormality, and incorporates it into the normal control process.

Images