Controllers and controller systems

Abstract

Embodiments relate to a controller and a control system. The controller of the embodiment includes: a communication port capable of communicating with another controller via a data transmission path; a connection port for connecting to a controlled device and capable of communicating with the other controller; a transmission control unit for transmitting a first status signal indicating the status of the controller of the present device from the communication port and the connection port, respectively, to the other controller; a reception control unit for receiving a second status signal indicating the status of the other controller from the other controller via the communication port and the connection port, respectively; and a status control unit for monitoring, when the present device is in a standby state, a failure of the other controller indicated by the second status signal received by the reception control unit and a non-reception state in which the reception control unit has not received the second status signal from both the communication port and the connection port for a predetermined period of time, and switching the present device from the standby state to the active state upon detecting at least one of the failure and the non-reception state.

Description

[0001] This application is an application that has entered the Chinese national phase of international application PCT / JP2021 / 021679 (international filing date: June 8, 2021), and is incorporated into this specification by reference to the above-mentioned international application. In addition, this application is based on Japanese patent application No. 2020-155659 (filing date: September 16, 2020) and enjoys its priority. This application incorporates the entire contents of the application by reference. Technical Field

[0002] Embodiments of the present invention relate to a controller and a controller system. Background Art

[0003] Conventionally, in controller systems such as DCS (Distributed Control System) and PLC (Programmable Logic Controller) that control industrial plants (hereinafter also referred to as "plants"), duplexing the controllers is considered to avoid temporary failures.

[0004] When controllers are duplicated (standby redundancy), constantly changing data is sent from the online side (the active controller) to the standby side (the standby controller) to equalize the data between the two. Furthermore, a mechanism is implemented to monitor each other's status. If an abnormality occurs on the online side, the standby side is immediately brought online to continue operations. Summary of the Invention

[0005] However, in the conventional art, when duplexing the controllers, dedicated hardware must be constructed to achieve data equivalence and mutual status monitoring, which leads to problems of labor and cost.

[0006] Therefore, an object of the embodiments of the present invention is to provide a controller and a controller system that can reduce the labor and cost involved in duplicating the controller.

[0007] The controller of the embodiment comprises: a communication port, which can communicate with other controllers via a data transmission path; a connection port, which is a port for connecting to a controlled object device and can communicate with the other controllers; a sending control unit, which sends a first status signal indicating the status of the controller of this device from the communication port and the connection port to the other controller respectively; a receiving control unit, which receives a second status signal indicating the status of the other controller from the other controller via the communication port and the connection port respectively; and a status control unit, which monitors, when the present device is in a standby state, a fault of the other controller indicated by the second status signal received by the receiving control unit, and a non-receiving state in which the receiving control unit does not receive the second status signal from both the communication port and the connection port for more than a specified time, and when at least one of the fault and the non-receiving state is detected, the status control unit switches the present device from the standby state to the working state. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 This is a block diagram showing the physical structure of the controller according to the first embodiment.

[0009] Figure 2 This is a block diagram showing the functional configuration of the controller according to the first embodiment.

[0010] Figure 3 It is a diagram schematically showing the overall configuration of the control system according to the first embodiment.

[0011] Figure 4 This is a flowchart executed by the controller in the standby state in the first embodiment.

[0012] Figure 5 It is a diagram schematically showing the overall configuration of a control system according to the second embodiment.

[0013] Figure 6 It is a diagram schematically showing the overall configuration of a control system according to the third embodiment.

[0014] Figure 7 It is a diagram schematically showing the overall configuration of a control system of a comparative example. DETAILED DESCRIPTION

[0015] Hereinafter, embodiments of a controller and a controller system according to the present invention will be described with reference to the accompanying drawings.

[0016] First, refer to Figure 7 A control system of a comparative example (conventional technology) will be described. Figure 7This figure schematically illustrates the overall configuration of a control system according to a comparative embodiment. The comparative control system includes a controller system, a PC (personal computer), a monitoring device, an Ethernet hub (Ethernet: a registered trademark), and I / O (input / output) devices.

[0017] The controller system includes a first controller (master), a second controller (slave), a shared memory, a dedicated signal circuit, and a control authority device.

[0018] The first controller and the second controller are connected via an Ethernet hub, a monitoring Ethernet, and a port. In addition, the first controller and the second controller are connected via an I / O device, an I / O network, and a port.

[0019] The first controller collects factory status information via the I / O network, performs various calculations, and outputs the results to the factory via the I / O network and I / O devices. The PC also includes an engineering tool for creating factory control applications and performing configurations. The monitoring device is a computer device used by operators to monitor factory status. The PC and monitoring device are connected via an Ethernet hub and a monitoring Ethernet network. Components connected to the Ethernet hub can communicate with each other.

[0020] The first controller and the second controller are hardware with the same configuration. Normally, the first controller is in the active state and the second controller is in the standby state. If the first controller stops due to an abnormality, the second controller switches to the active state.

[0021] The first controller stores data that changes constantly during plant control, local station information indicating whether it is operating or stopped, and partner station information indicating whether the second controller is operating or stopped. Similarly, the second controller also stores data, local station information, and partner station information.

[0022] The first controller sends data to the second controller via the shared memory, thereby equalizing the data. The first controller's own station information is sent via a dedicated signal circuit and stored as the second controller's partner station information. Similarly, the second controller's own station information is sent via a dedicated signal circuit and stored as the first controller's partner station information.

[0023] The physical location of the shared memory used for data transfer can be in the chassis where the first controller, the second controller, etc. are installed, or can be within each of the first controller and the second controller. In addition, data transfer is not limited to the shared memory method and can also be carried out via a dedicated communication line.

[0024] The local station information includes the operating mode and health counter information. The operating mode indicates the current status of the local controller (this device), including initialization, stop, operation, and error shutdown (fault). The health counter is incremented by software and is used by the other controller to monitor abnormalities caused by software failure.

[0025] The dedicated signal circuit is a hardware circuit used to communicate information to the local station and consists of multiple signal lines. To prevent the situation where two systems are online (both the first and second controllers are operating) in the event of a dedicated signal circuit failure, a control authority device is provided. The control authority device, for example, is a circuit such as a trigger that enables one of the first and second controllers to assume control authority. The controller with control authority can become online and, in the event of a stop or error shutdown, release control authority, allowing the other controller to assume control authority, thereby switching the online controller.

[0026] As described above, in the comparative example, duplicating the controllers requires the construction of dedicated hardware (such as a shared memory, dedicated signal circuits, and a control authority device) to achieve data equivalence and mutual status monitoring, which leads to labor-intensive and costly issues. Therefore, the following describes a technique for reducing the labor and cost involved in duplicating the controllers.

[0027] (First embodiment)

[0028] Figure 1 This is a block diagram showing the physical structure of the controller 1 according to the first embodiment. Figure 2 This is a block diagram showing the functional configuration of the controller 1 according to the first embodiment. Figure 3 It is a diagram schematically showing the overall configuration of the control system S according to the first embodiment.

[0029] The controller 1 is a device that controls a control target device (such as a sensor or actuator connected to the I / O device 5) to control a factory. The controller 1 can constitute a controller system with a duplicate controller together with other controllers.

[0030] like Figure 3 As shown, the control system S includes a controller system 1A, a PC 2, a monitoring device 3, an Ethernet hub 4, and an I / O device 5. The controller system 1A is a duplicated controller system consisting of a first controller 1a (controller 1) and a second controller 1b (controller 1) for controlling a controlled device.

[0031] The controller 1 is, for example, a DCS controller, a PLC, etc. The controller 1 includes a CPU (Central Processing Unit) 11, a RAM 12, a ROM 13, a storage device 14, a first interface 15, and a second interface 16. Figure 3 As shown, the first controller 1a includes ports P11 (first communication port) and P13 (first communication port) as Ethernet ports, and port P12 (first connection port) as an I / O port. The first controller 1a is connected to the monitoring Ethernet 6 via port P11, to the I / O network 7 via port P12, and to the tracking Ethernet 131 via port P13.

[0032] Similarly, the second controller 1b includes ports P21 (second communication port) and P23 (second communication port) as Ethernet ports, and port P22 (second connection port) as an I / O port. The second controller 1b is connected to the monitoring Ethernet 6 via port P21, to the I / O network 7 via port P22, and to the tracking Ethernet 131 via port P23.

[0033] return Figure 1 The CPU 11 performs overall control of the controller 1. The RAM 12 is a main storage device of the controller 1 and a work area of ​​the CPU 11.

[0034] The ROM 13 stores various programs such as firmware, application software, and an OS (Operating System) to be executed by the CPU 11 .

[0035] The storage device 14 is a non-volatile storage device, such as an SSD (Solid State Drive).

[0036] The first interface 15 is an interface for transmitting and receiving information with the Ethernet hub 4 and the like, and is connected to the port P1. The port P1 is an example of a communication port that can communicate with other controllers 1 via a data transmission path. In addition, only one port P1 is shown in the figure, but in practice, there may be two or more. For example, Figure 3 Ports P11, P13, ports P21, P23 correspond to Figure 1 port P1.

[0037] The second interface 16 is an I / O interface for transmitting and receiving information with the I / O device 5 and is connected to the port P2. The port P2 is an example of a connection port for connecting to a controlled device and capable of communicating with other controllers 1. In addition, only one port P2 is shown in the figure, but in practice, there may be two or more. For example, Figure 3 Port P12, Port P22, Figure 5 The actual data input port (DI114, DI214), the actual data output port (DO115, DO215) corresponds to Figure 1 port P2.

[0038] exist Figure 7 In the control system of the comparative example shown, a shared memory is used for data tracking between the first and second controllers, and a dedicated signal circuit is used for transmitting and receiving local station information. In the control system S of the first embodiment, a tracking Ethernet 131 is used instead. Data 111 from the first controller 1a is transmitted to the second controller 1b via path R1. Furthermore, assuming a failure in the tracking Ethernet 131, a mechanism is provided for transmitting and receiving local station information via the monitoring Ethernet 6 and via the I / O network 7.

[0039] For example, in reliability-critical DCS systems, monitoring Ethernet 6 and I / O network 7 are often configured as separate wiring systems. Together with tracking Ethernet 131, local station information can be transmitted and received across a total of five systems. This allows either the first controller 1a or the second controller 1b to monitor the status of the other without any issues, even if one or two systems fail. While the probability of all five systems failing is low, in this case, the controller will assume that the other system is powered off and will proceed online. Even if all five systems fail, two systems will be online. However, this is a state where only one system can output to the factory, rather than dual output from both systems, and thus presents no issues.

[0040] The controller 1 includes a calculation unit 101 , a transmission control unit 102 , a reception control unit 103 , and a state control unit 104 , which are functional components of modules implemented by the CPU 11 .

[0041] The calculation unit 101 performs various calculations. For example, the calculation unit 101 performs calculations based on various data related to the factory received from the I / O device 5 and generates data (data 111, 121).

[0042] The transmission control unit 102 performs various transmission controls. The transmission control unit 102 transmits a first status signal indicating the status of its own controller 1 to other controllers 1 via the communication port and the connection port. For example, the transmission control unit 102 transmits local station information (local station information 112 and 122: first status signal) indicating the status of its own controller 1 (the own device) to other controllers 1 using multiple data transmission paths (tracking Ethernet 131, monitoring Ethernet 6, and I / O network 7). Furthermore, if the own controller 1 is the first controller 1a, the other controller 1 is the second controller 1b. If the own controller 1 is the second controller 1b, the other controller 1 is the first controller 1a.

[0043] That is to say, if Figure 3 As shown, the local information 112 of the first controller 1a is sent to the second controller 1b via three paths R2, R11, and R12. In addition, the local information 122 of the second controller 1b is sent to the first controller 1a via three paths R3, R21, and R22.

[0044] The reception control unit 103 performs various reception controls. The reception control unit 103 receives second status signals indicating the status of other controllers 1 from other controllers 1 via various communication ports and connection ports. For example, the reception control unit 103 receives local station information (local station information 112, 122: second status signals) indicating the status of other controllers 1 from other controllers 1 using multiple data transmission paths (tracking Ethernet 131, monitoring Ethernet 6, and I / O network 7), and stores this information as partner station information (partner station information 123, 113).

[0045] The state control unit 104 switches its own controller 1 from the standby state to the active state, or vice versa. For example, when its own controller 1 is in the standby state, the state control unit 104 switches its own controller 1 from the standby state to the active state if the counterpart station information (counter station information 113, 123) received by the reception control unit 103 indicates a failure of the other controller 1, or if the reception control unit 103 does not receive any counterpart station information from either the communication port or the connection port for a predetermined period of time.

[0046] The PC 2 is an information processing device equipped with an engineering tool 21. The PC 2 is equipped with a control device such as a CPU, internal storage devices such as ROM and RAM, external storage devices such as HDD (Hard Disk Drive) and CD (Compact Disc) drive devices, display devices such as a monitor, and input devices such as a keyboard and a mouse, and is configured using the hardware of a conventional computer.

[0047] The engineering tool 21 is software (program) that manages the controller 1. For example, the engineering tool 21 generates an application program to be executed by the controller 1, transmits the generated application program to the controller 1, and monitors processes executed by the controller 1.

[0048] The monitoring device 3 is a computer device used by an operator to monitor the status of the plant.

[0049] The Ethernet hub 4 controls data communication among the first controller 1 a , the second controller 1 b , the PC 2 , the monitoring device 3 , and the like connected via the monitoring Ethernet 6 .

[0050] I / O devices 5 are used for input and output communication with devices that constitute the factory. Examples of I / O devices 5 include input devices (AI (Analog Input) devices and DI (Digital Input) devices) that input signals from sensors installed in the controlled facilities, and output devices (AO (Analog Output) devices and DO (Digital Output) devices) that output signals to actuators and other components of the controlled facilities.

[0051] Figure 4 This is a flowchart executed by the controller 1 in the standby state (hereinafter referred to as the second controller 1b) in the first embodiment. In step S1, the state control unit 104 of the second controller 1b in the standby state determines whether the local station information 112 (state signal) has not been received from the first controller 1a for a predetermined time period or longer. If so, the process proceeds to step S3; if not, the process proceeds to step S2.

[0052] In step S2, the status control unit 104 of the second controller 1b determines whether the status signal (the other station information 123 (the local station information 112 of the first controller 1a)) received from the first controller 1a is a status signal indicating a failure of the first controller 1a. If so, it proceeds to step S3; if not, it returns to step S1.

[0053] In step S3 , the state control unit 104 of the second controller 1 b switches the second controller 1 b from the standby state to the active state.

[0054] As described above, according to the controller system 1A of the first embodiment, by connecting the first controller 1a and the second controller 1b via the aforementioned multiple data transmission paths, it is possible to reduce the labor and cost involved in duplicating the controllers. Specifically, except for the addition of the tracking Ethernet 131, which is an Ethernet dedicated to tracking, the controller 1 can be duplicated simply by utilizing existing functions. This allows for the construction of a low-cost, reliable, and redundant controller 1 system.

[0055] Furthermore, even with an existing single controller, a switch to a dual system of controller 1 can be made simply by adding a tracking Ethernet 131 or by monitoring the use of Ethernet 6, without upgrading the hardware, but only by modifying the firmware of controller 1. In controllers 1 using recent computer architectures, there may be surplus Ethernet ports (e.g., ports P11 and P13 in the first controller 1a). In such cases, a dual system of controller 1 can be constructed without any hardware changes.

[0056] In the comparative example ( Figure 7 ) technology, if the information of the controller of the other system cannot be correctly read due to hardware failure or other factors, there is a risk that control authority cannot be obtained, causing both systems to stop. On the other hand, the controller system 1A of this embodiment can use redundant signals to confirm abnormal conditions of the other controller 1 with high reliability and perform dual management.

[0057] (Second embodiment)

[0058] Next, a second embodiment will be described. Detailed descriptions of matters similar to those of the first embodiment will be omitted as appropriate. Figure 5 This figure schematically shows the overall configuration of a control system S according to the second embodiment. In the second embodiment, the first controller 1a and the second controller 1b each include one communication port (ports P14 and P24), one or more actual data input ports (DI114 (first actual data input port), DI214 (second actual data input port)), and one or more actual data output ports (DO115 (first actual data output port), DO215 (second actual data output port)).

[0059] Furthermore, the first controller 1a and the second controller 1b are connected via a first data transmission path (monitoring Ethernet 6) using communication ports (ports P14 and P24). Furthermore, the actual data input port (DI114) of the first controller 1a and the actual data output port (DO215) of the second controller 1b are connected via a single data transmission path. Furthermore, the actual data output port (DO115) of the first controller 1a and the actual data input port (DI214) of the second controller 1b are connected via a second data transmission path. Furthermore, the first controller 1a transmits its own status signal (local station information 112) to the second controller 1b using the first and second data transmission paths. This is explained in detail below.

[0060] In a small-scale control system S, the monitoring Ethernet 6 is a single-line (wiring for one system), and local station information 112 and 122 can only be transmitted by one system via the monitoring Ethernet 6. Furthermore, there are no hardware resources to add additional Ethernet monitoring ports. Specifically, the controllers 1 (first controller 1a and second controller 1b) lack spare Ethernet ports.

[0061] Furthermore, since the I / O functions are direct DI (digital input) or DO (digital output), information cannot be transmitted via communications. In such a control system S, the amount of data (data 111, data 121) processed is small, and the communication volume on monitoring Ethernet 6 is also low. Therefore, monitoring Ethernet 6 can be used to track data (data 111, data 121). However, the transmission of local station information 112, 122 is performed solely by monitoring Ethernet 6, resulting in low reliability.

[0062] Therefore, by connecting DO115 of the first controller 1a to DI214 of the second controller 1b, pulse data is transmitted from the first controller 1a to the second controller 1b. Similarly, by connecting DO215 of the second controller 1b to DI114 of the first controller 1a, pulse data is transmitted from the second controller 1b to the first controller 1a. This configuration enables notification of the active / stopped local station information 112 and 122 via the I / O. Furthermore, by using pulse data with varying frequency or pattern, rather than simple pulse data, notification of the operating mode (the status of the controller 1) is also possible.

[0063] In this manner, the first controller 1a's local information 112 is transmitted to the second controller 1b via two paths R15 and R16. Furthermore, the second controller 1b's local information 122 is transmitted to the first controller 1a via two paths R25 and R26. Furthermore, the first controller 1a's data 111 is transmitted to the second controller 1b via path R4.

[0064] This ensures that two transmission paths for the local station information 112 and 122 are available, enabling the controller 1 to function as a duplicate system. Furthermore, if an abnormality occurs in both the monitoring Ethernet 6 and the I / O-side transmission path, monitoring and control are stopped, similar to a five-system failure in a large-scale system (control system S of the first embodiment). Therefore, operations are continued with both systems operating online. However, this is a state where only one side can output to the factory, not dual output from both systems, and there is no problem.

[0065] (Third embodiment)

[0066] Figure 6 This figure schematically shows the overall structure of the control system S of the third embodiment. Regarding matters similar to those of the first embodiment, descriptions are omitted as appropriate. Hereinafter, the first controller 1a is also referred to as the "master." "Master" indicates the physical location of dual redundancy (the priority side). In addition, the second controller 1b is also referred to as the "slave." "Slave" indicates the physical location of dual redundancy (the secondary side). When the power supply of the controller system 1A is turned on, the "master" is started first, the "master" becomes online, and the "slave" becomes the backup.

[0067] Furthermore, each of the first controller 1a and the second controller 1b determines whether its own controller 1 is in the active state or the standby state based on the IP (Internet Protocol) address (primary IP address) of the controller 1 to be in the active state and the IP address (secondary IP address) of the controller 1 to be in the standby state, as included in the download (DL) information from the PC 2 (the host device), and the settings of its own rotary switches (rotary switches 116 and 216). This is described in detail below.

[0068] As described above, the controller 1 has two types, "master" and "slave," depending on the installation location. In a memory clear state, the controller 1 cannot recognize whether it is "master" or "slave."

[0069] The first controller 1a and the second controller 1b each have a rotary switch 116 or 216 for setting the IP address of the monitoring Ethernet 6. The rotary switches 116 or 216 are required for communication via the monitoring Ethernet 6 and exist independently of the duplex function.

[0070] The DL information used by the user to set various settings for the controller 1 in the engineering tool 21 of the PC 2 includes a primary IP address and a secondary IP address. For example, the primary IP address is registered as "172.16.64.01" and the secondary IP address is registered as "172.16.64.02."

[0071] The user also sets the rotary switches 116 and 216 of the first and second controllers 1a and 1b to be used. For example, the user sets the rotary switch 116 of the first controller 1a to "01h" and the rotary switch 216 of the second controller 1b to "02h".

[0072] The engineering tool 21 of PC 2 downloads DL information to the "master" first controller 1a (IP address = 172.16.64.01). The first controller 1a itself cannot recognize itself as the "master", but because the engineering tool 21 downloads DL information using the IP address, the first controller 1a stores the DL information.

[0073] After the first controller 1a stores the DL information 117, it compares the primary IP address (172.16.64.01) and secondary IP address (172.16.64.02) in the DL information 117 with the setting (01h) of the rotary switch 116. In this case, since the rotary switch 116 is set to "01h," the first controller 1a determines itself as the "master." In other words, it enters the active state in response to a request from the engineering tool 21 on the PC 2.

[0074] Thereafter, the engineering tool 21 of the PC 2 requests execution of the second controller 1b. Specifically, since the first controller 1a is in the operating state and the second controller 1b is in the memory clear state, DL information is sent from the first controller 1a to the second controller 1b to perform equalization.

[0075] As a result, the IP address information is also reflected in the DL information 217 of the second controller 1b. The second controller 1b compares the IP primary address (172.16.64.01) and IP secondary address (172.16.64.02) in the DL information 217 with the setting (02h) of the rotary switch 216. In this case, the setting of the rotary switch 216 is "02h", so the second controller 1b determines that it is the "secondary".

[0076] In this manner, each controller 1 can recognize whether it is the “master” or the “slave” based only on the DL information from the engineering tool 21 of the PC 2 and the settings of the rotary switches 116 and 216 of the first and second controllers 1a and 1b.

[0077] The program executed by the controller 1 of each of the above-mentioned embodiments is provided as an installable or executable file recorded on a computer-readable recording medium such as a CD-ROM, floppy disk (FD), CD-R, or DVD (Digital Versatile Disk).

[0078] Alternatively, the program may be stored on a computer connected to a network such as the Internet and downloaded from the network. Alternatively, the program may be provided or distributed via a network such as the Internet. Alternatively, the program may be pre-loaded into a ROM or the like and provided.

[0079] The program executed by the controller 1 of each embodiment described above constitutes a module for realizing the above functions. As actual hardware, the CPU (processor) reads and executes the program from the storage medium to load each functional unit into the main storage device and realize each function.

[0080] While several embodiments of the present invention have been described above, these embodiments are provided as examples and are not intended to limit the scope of the invention. These new embodiments may be implemented in various other ways, and various omissions, substitutions, and modifications may be made without departing from the spirit of the invention. These embodiments and their variations are intended to be included within the scope and spirit of the invention and within the scope of the invention set forth in the claims and their equivalents.

Claims

1. A controller system comprising a first controller and a second controller, wherein: The first controller includes: a first communication port capable of communicating with the second controller via a data transmission path; and The first connection port is a port for connecting to an I / O device connected to a controlled device and is capable of communicating with the second controller. The second controller includes: a second communication port capable of communicating with the first controller via the data transmission path; a second connection port for connecting to an I / O device connected to the control target device and capable of communicating with the first controller; as well as A status control unit, when the first controller is in an operating state and the second controller is in a standby state, monitors a fault indicated by a status signal from the first controller received from one of the second communication port and the second connection port, and a non-reception state in which no status signal from the first controller is received from both the second communication port and the second connection port for more than a specified time, and switches the second controller from the standby state to the operating state when at least one of the fault and the non-reception state is detected.

2. The controller system of claim 1, wherein: The first controller includes a first actual data input port and a first actual data output port as the first connection port. The second controller includes a second actual data input port and a second actual data output port as the second connection port. The first actual data input port of the first controller and the second actual data output port of the second controller are connected via a first transmission path. The first actual data output port of the first controller and the second actual data input port of the second controller are connected via a second transmission path. The second controller is: When the first controller is in working state and the second controller is in standby state, when a status signal indicating a fault is received from the first controller from one of the second communication port and the second actual data input port, or when no status signal is received from the first controller from both the second communication port and the second actual data input port for more than a specified time, the second controller is switched from standby state to working state.

3. The controller system of claim 1, wherein: The first controller and the second controller respectively determine whether the device is in the working state or the standby state based on the IP address of the controller that should be in the working state and the IP address of the controller that should be in the standby state included in the download information from the upper-level device, as well as the setting of the rotary switch of the device.

Images