Process control system, process control device, and program update method

Abstract

The present invention relates to a process control system, a process control device, and a program update method. A first process control device in a process control system executes a non-update target program which is not an update target and an update target program which can be an update target, suspends the non-update target program based on a suspension request from outside, and transfers a context of the non-update target program to a second process control device. A second process control device in the process control system executes the non-update target program which is not an update target and the update target program after update, restores the context of the non-update target program by using the transferred context, initializes a context of the update target program, and causes a second program execution unit to resume the non-update target program and the update target program based on a resumption request from outside.

Description

[0001] This application is a divisional application of the invention patent application filed on September 26, 2019, with application number 201910917030.1 and entitled "Process Control System, Process Control Device and Program Update Method". Technical Field

[0002] This disclosure relates to process control systems, process control devices, and program update methods. Background Technology

[0003] In related technologies, process control systems are established in factories, manufacturing plants, etc. (hereinafter referred to as "factories" when collectively described below) and configured to control various state variables (e.g., pressure, temperature, flow rate, etc.) of industrial processes, thereby implementing advanced automated operations. Specifically, the controller, as the core of the process control system, acquires the detection results of multiple sensors (flow meters, thermometers, etc.), obtains the operating parameters of actuators (valves, etc.) based on the detection results, and operates the actuators based on the operating parameters, thereby controlling various state variables.

[0004] The process control systems of related technologies were built using dedicated equipment with proprietary specifications. More recently, process control systems are becoming increasingly open, and in many cases, they are built using general-purpose equipment (computers, workstations, etc.) with open specifications. In process control systems using general-purpose equipment, hardware must be replaced and software updated, as is the case with general information systems. Simultaneously, enhancements to the operating system (OS) functionality and the correction of operating system errors and vulnerabilities can be exemplified as software upgrades.

[0005] JP-A-H11-3240 (hereinafter referred to as PTL 1) discloses a technique for changing the system program in a computer system for control, equipped with duplex processing units (control side and standby side), without affecting the control objective. Specifically, the standby side stops to load a new system program and is then activated; application data stored on the control side is copied to the standby side; the control side stops and the standby side is activated as the control side, thus changing the system program without affecting the control objective.

[0006] Furthermore, JP-A-2015-5258 (hereinafter referred to as PTL 2) discloses a process control device that can update the operating system without stopping the process control system and ensure the continued operation of applications on the updated operating system.

[0007] In process control systems such as those disclosed in PTL 1 and PTL 2, it is necessary to update a program that can be the target of the update (referred to as the "target update program") while continuing to operate the process control system without stopping it. In this case, it is necessary to update the target update program simply and quickly without running complex analyses and processes. The target update program is the program to be updated.

[0008] This disclosure is made in view of the above circumstances, and the purpose of this disclosure is to provide a process control system, process control device and program update method that can easily and quickly update the target program while continuing to operate the process control system without stopping the process control system. Summary of the Invention

[0009] A process control system related to one aspect of the present invention includes: a first process control device; and a second process control device. The first process control device includes: a first program execution unit configured to execute a non-updating target program that is not an update target and an update target program that can be an update target; and a first program update manager configured to suspend the non-updating target program based on a pause request from an external source and to transmit the context of the non-updating target program to the second process control device. The second process control device includes: a second program execution unit configured to execute the non-updating target program that is not an update target and the updated target program after the update; and a second program update manager configured to restore the context of the non-updating target program using the context transmitted from the first program update manager, initialize the context of the update target program, and cause the second program execution unit to resume the non-updating target program and the update target program based on a restart request from an external source.

[0010] In a process control system related to one aspect of the present invention, when it is determined that the processing of an update target program requested by a non-update target program is in progress, a first program update manager is configured to set the running position of the non-update target program to a position immediately preceding the request to process the update target program, and delete information indicating that the processing of the update target program is in progress.

[0011] In a process control system related to one aspect of the present invention, when it is determined that the processing of an update target program called by a non-update target program is in progress, a first program update manager is configured to wait until the update target program completes the in-progress processing.

[0012] In a process control system related to one aspect of the present invention, when it is determined that an update target program is being processed in progress among update target programs not called by the update target program, a first program update manager is configured to: prevent requests for pre-registered update target programs among the update target programs from being transmitted to other update target programs; wait for the processing of the update target program to stop; after the processing of the update target program stops, extract recovery data required to restart processing from the context of the pre-registered update target program; and transmit the extracted recovery data to a second process control device. A second program update manager is configured to restore the context of the pre-registered update target program after an update by using the recovery data transmitted from the first program update manager.

[0013] In a process control system related to one aspect of the present invention, when a response indicating the result of the first predetermined process and a request for a second predetermined process are received in response to a request for a first predetermined process, an update target program is configured to perform communication with other devices by using a request / response protocol in order to notify the response indicating the result of the second predetermined process.

[0014] In a process control system related to one aspect of the present invention, when the target program to be updated is a communication driver used to enable communication with other devices, a first program update manager is configured to block the receiving port of the target program to be updated, so that no new requests are received from other devices.

[0015] A process control apparatus related to one aspect of the present invention includes: a program execution unit configured to execute a non-updating target program that is not an update target and an update target program that can be an update target; a first program update manager configured to suspend the non-updating target program based on a pause request from an external source and to transmit the context of the non-updating target program; and a second program update manager configured to restore the context of the non-updating target program by using the context transmitted from the first program update manager, initialize the context of the update target program after an update, and cause the program execution unit to restart the non-updating target program and the updated target program after the update based on a restart request from an external source.

[0016] A program update method related to one aspect of the present invention is a method in a process control apparatus in which a non-updating target program (not an update target) and an update target program (potentially an update target) are run. The program update method includes: a first step of pausing the non-updating target program based on a pause request from an external source and transmitting the context of the non-updating target program; and a second step of restoring the context of the non-updating target program (not an update target) using the context transmitted in the first step, initializing the context of the update target program after the update, and restarting both the non-updating target program and the update target program based on a restart request from an external source.

[0017] In a program update method related to one aspect of the present invention, the first and second steps are performed in the same process control device.

[0018] In a program update method related to one aspect of the present invention, the first and second steps are operated in different process control devices.

[0019] According to this disclosure, the target program can be updated simply and quickly, while the process control system can continue to operate without stopping the process control system. Attached Figure Description

[0020] Figure 1 It is a functional configuration diagram depicting an illustrative functional configuration of a process control system according to a first exemplary embodiment of the present disclosure;

[0021] Figure 2 This is a schematic configuration diagram depicting a detailed configuration of a program to be operated in a process control apparatus in a first exemplary embodiment of this disclosure;

[0022] Figure 3 This is a schematic diagram depicting a typical calling relationship between a non-updating target program and an updating target program in a first exemplary embodiment of this disclosure;

[0023] Figure 4 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in a first exemplary embodiment of this disclosure;

[0024] Figure 5 This is a flowchart depicting a program update method according to a first exemplary embodiment of the present disclosure;

[0025] Figure 6 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in a second exemplary embodiment of this disclosure;

[0026] Figure 7This is a flowchart depicting a program update method according to a second exemplary embodiment of the present disclosure;

[0027] Figure 8 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in the third exemplary embodiment of this disclosure;

[0028] Figure 9 This is a flowchart depicting a program update method according to a third exemplary embodiment of the present disclosure;

[0029] Figure 10 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in the fourth exemplary embodiment of this disclosure;

[0030] Figure 11 This is a flowchart depicting a program update method according to a fourth exemplary embodiment of the present disclosure;

[0031] Figure 12 This is a flowchart depicting a program update method according to a fourth exemplary embodiment of the present disclosure;

[0032] Figure 13 This is a functional configuration diagram depicting a schematic functional configuration of a process control system according to a fifth exemplary embodiment of the present disclosure;

[0033] Figure 14 A request / response protocol that will be used in a fifth exemplary embodiment of this disclosure is shown;

[0034] Figure 15 This is a functional configuration diagram depicting a schematic functional configuration of a process control system according to a sixth exemplary embodiment of the present disclosure;

[0035] Figure 16 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in the sixth exemplary embodiment of this disclosure;

[0036] Figure 17 This is a flowchart depicting a program update method according to a sixth exemplary embodiment of the present disclosure;

[0037] Figure 18 This is a functional configuration diagram depicting a schematic functional configuration of a process control system according to a seventh exemplary embodiment of the present disclosure;

[0038] Figure 19 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in the seventh exemplary embodiment of this disclosure;

[0039] Figure 20This is a flowchart depicting a program update method according to a seventh exemplary embodiment of the present disclosure;

[0040] Figure 21 This is a block diagram depicting an example of a process control system according to exemplary embodiments of the present disclosure applied to a system configured to control an industrial process; and

[0041] Figure 22 This is a functional block diagram depicting a schematic functional configuration of a process control device according to another exemplary embodiment of the present disclosure. Detailed Implementation

[0042] In the following, a process control system, process control apparatus, and program update method according to exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. The following will first describe an overview of exemplary embodiments of the present disclosure, followed by definitions of concepts, terms, etc., used in the exemplary embodiments of the present disclosure. Subsequently, the methods used in the exemplary embodiments of the present disclosure will be described, followed by details of each exemplary embodiment.

[0043] [Overview]

[0044] The exemplary embodiments disclosed herein will allow for simple and rapid updates to the target program while continuing operation of the process control system without halting its operation. Specifically, since process control systems often require continuous operation over long periods, ranging from months to years, to achieve even slight increases in production efficiency, it is not possible to freely stop an operating process control system. For example, stopping a process control system is generally not permitted, except, for example, for periodic maintenance or shutdown to ensure plant safety. This is because if an unexpected interruption occurs during the continuation of a chemical reaction, the semi-finished products produced up to that point in the chemical process may become unusable, resulting in significant losses.

[0045] Furthermore, from a safety perspective, process control systems are required to be free from malfunctions or deficiencies. Therefore, when a cause of malfunction (such as an operating system error or vulnerability) is discovered, immediate action must be taken to resolve the cause (updating the operating system). However, as mentioned above, since it is not possible to freely stop the process control system, it is not possible to take immediate action even when a cause of malfunction is discovered.

[0046] Therefore, when using the techniques disclosed in PTL 1, in a redundantly configured control unit, continuous application operation can be achieved by updating the system program on the standby side without significantly affecting the control side and copying the application data from the control side up to the standby side. However, the method for extracting the application data to be copied and the method for restarting processing after the update depend on the application design, and the methods are confidential.

[0047] Furthermore, when using the techniques disclosed in PTL 2, processing of any application can continue while updating the operating system of the control device. However, since the techniques disclosed in PTL 2 presuppose application recovery, complex analysis and processing may be required. Additionally, recovery processing of the internal state, which depends on the functionality of the operating system, may be necessary.

[0048] To update programs such as operating systems that require updates (the target program) while continuing to operate process control systems without running complex analyses and processes, simpler and more widely available solutions are needed. For example, a method is needed that does not require a complete restoration of the operating system's internal state, or a method that never considers or needs to restore the operating system's internal state.

[0049] In an exemplary embodiment of this disclosure, when updating various programs to be used in the process control system, a non-updating target program (not the target of the update) is paused based on a pause request from an external source, and the context of the non-updating target program is transmitted. Then, based on a restart request from an external source, the transmitted context is used to restore the context of the non-updating target program (not the target of the update); the context of the updated target program after the update is initialized; and both the non-updating target program and the updated target program are restarted. Thus, the updated target program can be updated simply and quickly while the process control system continues to operate without stopping the process control system.

[0050] [Definitions of concepts, terms, etc.]

[0051] The exemplary embodiments of this disclosure can be implemented using a computer. On a computer, multiple tasks operate under the management of an operating system (OS). The operating system manages various resources of the computer (CPU time, memory, input / output devices, etc.) and allocates resources appropriately to tasks. Meanwhile, "CPU" is an abbreviation for Central Processing Unit.

[0052] A task is a processing unit that operates independently under the control of the operating system. Multiple tasks can operate concurrently. The operating system is configured to provide communication capabilities between tasks. Information (messages) can be exchanged between multiple tasks to enable concurrent operation through inter-task communication. In addition to inter-task communication, information can also be exchanged between tasks using methods such as shared memory.

[0053] In exemplary embodiments of this disclosure, the various programs to be used in the process control system are classified into two types: non-updating target programs and updating target programs. In exemplary embodiments of this disclosure, non-updating target programs are programs that remain unchanged before and after a program update. The primary function of non-updating target programs is to implement applications. Here, applications typically use PID control, sequential control, etc., to control a specific plant.

[0054] In exemplary embodiments of this disclosure, an update target program is a program that is called directly or indirectly from a non-update target program, except in cases described later. The primary function of an update target program is to smoothly utilize the resources of the computer system. An update target program is a so-called system program. Update target programs are provided as part of an operating system or middleware. An exception to update target programs is a calling-side update target program. As described later, a calling-side update target program is, for example, a program that has the functionality to invoke (activate) a non-update target program based on an external trigger.

[0055] Tasks can be categorized into persistent tasks and usage tasks. A persistent task is one that runs a non-updating target program. However, updating the target program can be included in a persistent task. Meanwhile, a usage task is one used solely to run an updating target program. That is, a persistent task can directly or indirectly call a usage task. Here, "call" is not limited to function calls and procedure calls. Communication between tasks, system calls, and operations that use another program or the functionality of another program through other information communication are all referred to as "calls."

[0056] A context is the situation a program relies on during execution. Context is also called situation, declaration step, state, data, storage, etc. The physical entity of a context is the data to be stored in a storage device (semiconductor memory, disk drive, external media, etc.). A software context includes all contents of the storage areas used by the program, such as memory.

[0057] When the software context can be restored, the suspended program can be resumed unconditionally (the general principle of continuation). Furthermore, when the software context is initialized for reconstruction, the program can be updated unconditionally (the general principle of updating). In exemplary embodiments of this disclosure, based on these two general principles, the target program is updated simply and quickly while the process control system continues to operate without stopping the process control system.

[0058] Context-dependent indicates that the execution of program processing depends on the context. Context dependence is also known as state dependency, statefulness, etc. Context-independent indicates that the execution of program processing does not depend on the context (in other words, there is no context). Context-independent is also known as declaration-step-independent, no-declaration-step, state-independent, stateless, stateless, etc.

[0059] The active device is the device that is currently in operation. The updating device is the device that is not currently in operation and is on standby for program updates. The states of the active device and the updating device can switch between each other. That is, a device operating as an active device switches to a standby state and becomes an updating device, and a device in a standby state that is an updating device switches to an operating state and becomes an active device.

[0060] A model (example) of typical processing is described when exemplary embodiments of this disclosure are applied to the control of an industrial process. An updated target program from the calling side repeatedly invokes a non-updating target program for controlling the process at intervals of any time (e.g., from 50 milliseconds to several seconds). On each invocation, the non-updating target program runs processes 1 through 4 below.

[0061] 1. Non-updating target programs run the current processing by using a context that is the processing state up to the previous processing (while setting initial values ​​for the first context).

[0062] 2. Non-updating target programs acquire necessary information (e.g., the current positions of various sensors as the state of an industrial process) and the results of other control processes.

[0063] 3. Non-updating target programs perform computational processing based on the acquired information (e.g., PID control, sequential control, and control simulation).

[0064] 4. Non-updating target programs output information based on the results of computational processing (e.g., the operation of actuators in production equipment, the on / off state of switches).

[0065] In this scenario, at the micro level, the non-updated target program controls the industrial process in a discrete time sequence. However, since the industrial process continues to change even during periods when the non-updated target program is not running, the plant's production equipment continues to operate. Furthermore, the range of time periods during which the non-updated target program is invoked from the calling-side updated target program is not limited to the range illustrated above.

[0066] Pausing a non-updating target program is a temporary halt to the program, allowing it to resume its previous processing within a predetermined timeframe after the previous processing has finished. When the non-updating target program resumes, its context is taken over from the paused program. Here, the "predetermined timeframe" is a sufficiently short period determined by design considerations.

[0067] Interruption of a non-updating target program means stopping the updating target program so that the previous processing of the non-updating target program will not restart within a predetermined time after the previous processing has ended, or preventing the context of the non-updating target program from being taken over (e.g., initializing the state of the processing), regardless of whether the previous processing restarts within the predetermined time. Considering the purpose of the process control system, i.e., the control of industrial processes, pausing the non-updating target program is permitted, but interrupting the non-updating target program is not permitted.

[0068] In exemplary embodiments of this disclosure, "request" and "response" include requests and responses that occur within and between devices. For example, a "request" includes calling a function, invoking a system call, a request to transmit communication between tasks, a request to transmit a request in network communication, etc. A "response" includes returning from a function call, returning from a system call, replying to the processing result of communication between tasks, replying to a response in network communication, etc.

[0069] In exemplary embodiments of this disclosure, "in progress" indicates a context state that needs to be maintained because a series of processes have not been completed within or between devices. A series of processes can be completed by performing one or more exchanges of requests and responses. When a series of processes is completed, a non-in progress state is entered and the context can be initialized. Meanwhile, network communication processing is performed between two devices; after transmitting a request to another device, the processing of one device is in progress until it receives a response (ACK in the case of a common communication protocol) from that other device. For example, while in progress, a TCP connection needs to be maintained, etc.

[0070] [Method to use]

[0071] In the exemplary embodiments described later, for a non-updated target program, based on the general principle of continuation, all context (software context) used by the non-updated target program is unconditionally copied during the pause. For each program, the takeover data required to continue the non-updated target program is different. However, the takeover data necessary for continuing the non-updated target program can be included in the context, and that takeover data can be taken over using the "copy all" method described above.

[0072] Conversely, updating the target program involves partially correcting its existing functionality and adding new functionality to it. In this case, whether the newly added functionality is related to existing functionality is not an issue. That is, the new functionality can be completely different from existing functionality. Therefore, updating the target program may significantly change the data structures of its context. In this case, based on the general principles of updating, a method is used to unconditionally initialize all contexts used by the target program upon restarting. Through initialization, the target program can be updated unconditionally.

[0073] In the exemplary embodiments described later, the target program is updated using the method described above during periods when the target program is not being updated. Therefore, in the exemplary embodiments described later, the target program can be updated simply and quickly while the process control system continues to operate without stopping its operation.

[0074] (First exemplary embodiment)

[0075] Functional Configuration of Process Control System

[0076] Figure 1 This is a functional configuration diagram depicting an illustrative functional configuration of a process control system according to a first exemplary embodiment of the present disclosure. (As shown...) Figure 1 As shown, the process control system 1 of the first exemplary embodiment includes a process control device 10 (first process control device), a process control device 20 (second process control device), and engineering facilities 30. The process control device 10 and process control device 20 are implemented using equivalent or similar computers. In the first exemplary embodiment, the process control device 10 may be referred to as an "activation device," and the process control device 20 may be referred to as an "update device."

[0077] In the first exemplary embodiment, in order to update the program, the function operating in the process control device 10 is switched to the process control device 20. That is, firstly, the process control device 10, as the active device, operates to control the process, and the process control device 20, as the update device, is on standby. Thereafter, based on the instruction signal from the engineering facility 30, the process control function of the process control device 10 (active device) is suspended, and the function is restarted in the process control device 20 (update device). The process control device 10 and the process control device 20 have the function of updating the program while the system is operating.

[0078] The process control device 10 has the functions of hardware 11 (first program execution unit), operating system 12, tasks 13 and 14, and program update manager 15 (first program update manager). Hardware 11 includes a CPU, memory, input / output devices, communication devices, etc., and is configured to run various programs (including non-updating target programs and updating target programs) that will be used in the process control device 10. Simultaneously, the functions are implemented by the hardware 11 running programs used to implement the functions of the process control device 10. That is, the functions of the process control device 10 are implemented through the cooperation of software and hardware resources.

[0079] Operating system 12 resides between hardware 11 and applications (tasks 13 and 14, etc.) and is configured to provide a defined interface to applications while managing hardware 11. Specifically, operating system 12 has the function of managing the hardware resources (CPU time, memory, input / output, etc.) of process control device 10 and appropriately allocating them to each task. Operating system 12 includes an update target program PB13.

[0080] Task 13 is a task with the function of controlling the target process. Task 13 is also referred to as the "control task". Task 13 includes the non-updating target program PA11 and the updating target program PB11. The non-updating target program PA11 is the main program used to control the process. Task 14 is a task that provides a predetermined service based on a direct or indirect request from Task 13. Task 14 is also referred to as the "use task". Task 14 includes the updating target program PB12.

[0081] The program update manager 15 is configured to control the switching process from the active device to the update device (also known as "online update") while the operating system is running. Specifically, when a pause request is transmitted from the engineering facility 30, the program update manager 15 executes the processes required to pause the non-update target program PA11 and resumes its function in the process control device 20 (update device). The processes that the program update manager 15 will execute will be described in detail later. Simultaneously, the program update manager 15 can also execute the processes required to pause the update target program and resume its function.

[0082] Process control device 20 has a similar configuration to process control device 10 and includes the functions of hardware 21 (second program execution unit), operating system 22, tasks 23 and 24, and program update manager 25 (second program update manager). Hardware 21 is similar to hardware 11 and is configured to run various programs (including non-updating target programs and updating target programs) that will be used in process control device 20. Simultaneously, the functions of process control device 20 are implemented through the cooperation of software and hardware resources.

[0083] Operating system 22 has similar functions to operating system 12. Furthermore, operating system 22 includes the update target program PB23. Task 23 has similar functions to task 13. Furthermore, task 23 includes a non-update target program PA21 and an update target program PB21. Task 24 has similar functions to task 14. Furthermore, task 24 includes the update target program PB22. Program update manager 25 has similar functions to program update manager 15. Simultaneously, program update manager 25 is configured to operate in conjunction with program update manager 15.

[0084] Furthermore, the designation of "activation device" and "update device" depends on the circumstances at a given time, and the functions of process control device 10 and process control device 20 can change depending on the circumstances. That is, process control device 20 can be used as an activation device, and process control device 10 can be used as an update device. Moreover, three or more process control devices can be used to perform program updates and switching of operation of process control devices.

[0085] Engineering facility 30 is configured to perform various engineering operations within process control system 1 using plant design information, including design information for process control system 1. Furthermore, engineering facility 30 is configured to issue commands to suspend the process control function of process control device 10 (active device) and restart that function in process control device 20 (updating device). Engineering facility 30 is implemented, for example, by a computer such as a workstation or a personal computer.

[0086] Figure 2 This is a schematic configuration diagram depicting a detailed configuration of a program to be operated in a process control device in a first exemplary embodiment of this disclosure. Figure 2 The internal configuration of process control device 10 is depicted, but the internal configuration of process control device 20 is similar. For example... Figure 2 As shown, every program has a context. Context is the state of the situation in which the program is operating. Specifically, context is data stored in semiconductor memory, disk devices, etc. For example, the data could be data in the CPU's memory space, or it could be data managed by a Database Management System (DBMS).

[0087] In a first exemplary embodiment, the state indicated by the data may be referred to as a "context," and the storage device used to physically store the data may also be referred to as a "context." Furthermore, the context may include information about the execution location of each program (a specific location within the program code).

[0088] exist Figure 2In the example, task 13 includes a non-updating target program PA11, an updating target program PB11, and an updating target program PB14. The updating target program PB11 is a dedicated internal function for the non-updating target program PA11 and is statically linked with PA11 to form module MD. Within module MD, the non-updating target program PA11 can call the updating target program PB11.

[0089] Furthermore, the update target program PB14 is a common function shared by module MD and other modules, and is dynamically linked with module MD, etc. Module MD and update target program PB14 can call each other through a predefined API (Application Programming Interface). Update target program PB14 is, for example, a library program used to easily utilize OS functions.

[0090] Operating system 12 includes update target program PB13. Update target program PB13 is a program used to implement OS functions. Update target program PB13 can be invoked from tasks 13 and 14. Task 14 includes update target program PB12.

[0091] exist Figure 2 The document describes the relationship between programs and contexts. In Task 13, the non-updating target program PA11 accesses context CA11, the updating target program PB11 accesses context CB11, and the updating target program PB14 accesses context CB14. In Task 14, the updating target program PB12 accesses context CB12. In Operating System 12, the updating target program PB13 accesses context CB13. Furthermore, access from a program to a context can be for reference only or can be accompanied by writing.

[0092] Figure 2 The non-updating target program PA11 in the illustrated program is a continuing target program. That is, the non-updating target program PA11 is not an updating target. Furthermore, the updating target programs PB11, PB12, PB13, and PB14 are programs that can be updated targets. When an updating target program is updated, the non-updating target program continues operation while simultaneously switching the operating environment from the active device to the updating device.

[0093] An important aspect of simultaneous updates to the operating system is that the non-updating target program and the updating target program do not share context. That is, the non-updating target program PA11 does not directly access the contexts CB11, CB12, CB13, and CB14, which are the context of the updating target program. Furthermore, the updating target programs PB11, PB12, PB13, and PB14 do not directly access the context CA11, which is the context of the non-updating target program PA11.

[0094] Figure 3 This is a schematic diagram depicting a typical calling relationship between a non-updating target program and an updating target program in a first exemplary embodiment of this disclosure. For example... Figure 3 As shown, the calling-side update target program PC11 is the program that calls the non-updating target program PA11. Update target programs other than the calling-side update target program PC11 are called directly or indirectly from the non-updating target program PA11.

[0095] Specifically, the calling-side update target program PC11 receives external triggers from the calling non-updating target program PA11. These external triggers are, for example, timeout signals from a fixed-time timer or receive interrupt signals from the network. These external triggers are repeatedly transmitted to the calling-side update target program PC11. Consequently, the calling-side update target program PC11 repeatedly activates the non-updating target program PA11.

[0096] During the execution of the non-updating target program, the non-updating target program PA11 does not directly or indirectly call the updating target programs PB13, PB14, and PB15. No trigger wait occurs during the execution of the non-updating target program PA11. When processing is complete, the non-updating target program PA11 returns control to the calling updating target program PC11 without stopping processing (trigger wait).

[0097] Furthermore, the non-updating target program PA11 can be paused for online program updates. The timing of pausing the non-updating target program PA11 is either immediately before the call from the calling-side updating target program PC11 to the non-updating target program PA11, or immediately after the return from the non-updating target program PA11 to the calling-side updating target program PC11. Therefore, during the program update, processing returns to the calling side of the non-updating target program PA11, and all stack areas used by the non-updating target program PA11 are released. Therefore, the stack area is not included in the context CA11 of the paused non-updating target program PA11.

[0098] Figure 4 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in a first exemplary embodiment of this disclosure. Figure 4 In the middle, the program update manager 15 is the active device ( Figure 1 The process control device 10 in the middle has the function of updating the device. Furthermore, the program update manager 25 is the update device ( Figure 1The process control device 20 has the functions of both the program update manager 15 and the program update manager 25. The program update manager 15 and the program update manager 25 are configured to operate in coordination with each other. The process control device has the functions of both the program update manager 15 and the program update manager 25, and is configured to switch between operating as an active device or an update device.

[0099] like Figure 4 As shown, the program update manager 15 includes a communication management unit 151 and a non-updating target program call stop unit 152. Furthermore, the program update manager 25 includes a communication management unit 251, a non-updating target program call restart unit 252, and a context initialization control unit 253. Meanwhile, process control devices 10 and 20 are respectively connected to the engineering facility 30 via a network. The communication management unit 151 of process control device 10 and the communication management unit 251 of process control device 20 are respectively configured to perform communication with the engineering facility 30 via the network.

[0100] When the communication management unit 151 receives a request (pause request) transmitted from the engineering facility 30, the communication management unit 151 issues an instruction to the non-updating target program call stop unit 152 to pause the non-updating target program PA11. Furthermore, upon completion of the processing (pause processing) of the request from the engineering facility 30, the communication management unit 151 changes the context CA11 of the non-updating target program PA11 (see...). Figure 2 The data is transmitted to the update device, and the engineering facility 30 is notified that the processing has been suspended.

[0101] The non-updating target program call stop unit 152 is configured to suspend the non-updating target program PA11 according to an instruction issued from the communication management unit 151. Specifically, the non-updating target program call stop unit 152 suspends the call to the non-updating target program PA11. More specifically, the non-updating target program call stop unit 152 stops the call to the updating target program PC11 on the calling side (see...). Figure 3 The non-updating target program PA11 is invoked to pause the non-updating target program PA11. When the pause of the non-updating target program PA11 is completed, the non-updating target program invokes the stop unit 152 to notify the communication management unit 151 that the pause process has been completed.

[0102] At the same time, when the non-updating target program PA11 is paused, the program update manager 15 runs the context CA11 of the non-updating target program PA11 (see... Figure 2 The processing stored in the storage device (not shown) is handled by the communication management unit 151, which reads the context CA11 stored in the storage device and transmits it to the update device. The processing that stores the context CA11 in the storage device can also be executed by a non-updating target program calling the stop unit 152.

[0103] When the communication management unit 251 receives a request (restart request) transmitted from the engineering facility 30, it issues an instruction to the non-updating target program restart unit 252 to restart the non-updating target program PA11. The communication management unit 251 stores (copies) the context (context CA11 of the non-updating target program PA11) transmitted from the communication management unit 151 in the same area (address) as the active device. Thus, a state equivalent to the pause of the non-updating target program PA11 is reproduced in the process control device 20. Furthermore, when the processing requested from the engineering facility 30 (restart processing) is completed, the communication management unit 251 notifies the engineering facility 30 that the restart processing has been completed.

[0104] The non-updating target program call restart unit 252 is configured to restart the non-updating target program PA11 according to an instruction issued from the communication management unit 251. Specifically, the non-updating target program call restart unit 252 runs the activation program of the process control device 20, and causes the calling side to update the target program PC11 (e.g., Figure 3 (As shown) can call the non-updating target program PA21 (see...) Figure 1 At the same time, since the non-updating target program PA21 is the same program as the non-updating target program PA11, the call to the non-updating target program PA21 is synonymous with the call to the non-updating target program PA11.

[0105] The non-updating target program call restart unit 252 enables the context initialization control unit 253 to perform processing after an instruction is issued from the communication management unit 251, even before processing has run in the context initialization control unit 253. The non-updating target program call restart unit 252 is configured to restart the calling-side updating target program PC11, such that the calling-side updating target program PC11 (e.g., Figure 3 As shown, the non-updating target program PA21 will be invoked. When the restart of the non-updating target program PA11 (non-updating target program PA21) is completed, the non-updating target program invokes the restart unit 252 to notify the communication management unit 251 that the restart process has been completed.

[0106] The context initialization control unit 253 is configured to issue an instruction to the operating system 22 regarding whether to initialize the context based on the instruction issued by the non-updating target program's restart unit 252. Specifically, the context initialization control unit 253 bypasses the context initialization process of the non-updating target program PA11's context CA11 and issues an instruction allowing the initialization of the update target program's context. Simultaneously, when the context initialization process is complete, the context initialization control unit 253 notifies the non-updating target program's restart unit 252 that the initialization process has been completed.

[0107] <Program Update Method>

[0108] Figure 5 This is a flowchart depicting a program update method according to a first exemplary embodiment of the present disclosure. As a running... Figure 5 As per the flowchart shown, the process control unit 10 (active unit) operates by using the updated target program before updating. Furthermore, the process control unit 20 (updating unit) is in standby mode with the updated target program installed. Non-updated target programs are not updated, and the same programs (non-updated target programs and PA11 and PA21) run in both process control unit 10 and process control unit 20.

[0109] Furthermore, at appropriate timings, a request (pause request) is transmitted from engineering facility 30 to process control device 10 (active device), and at appropriate timings, a request (restart request) is transmitted from engineering facility 30 to process control device 20 (updating device). That is, engineering facility 30 first transmits a pause request message to process control device 10. Then, engineering facility 30 receives a message from process control device 10 indicating completion of the pause. Then, engineering facility 30 transmits a restart request message to process control device 20. Then, engineering facility 30 receives a restart completion message from process control device 20.

[0110] Simultaneously, after transmitting a pause request message to process control device 10, engineering facility 30 enables process control device 10 to issue a restart request to process control device 20. When process control device 10 is able to issue a restart request, engineering facility 30 does not transmit a restart request message to process control device 20. Instead, process control device 10 may notify process control device 20 of a completion message indicating the pause, thereby requesting a restart from process control device 20.

[0111] like Figure 5As shown, the process control device 10 (active device) receives a message (request for pause) transmitted from the engineering facility 30 (step S11). Specifically, this message is received by the communication management unit 151 of the program update manager 15 provided in the process control device 10 (active device). When the message transmitted from the engineering facility 30 is received, the communication management unit 151 outputs an instruction to pause the non-updating target program PA11 to the non-updating target program call stop unit 152.

[0112] Therefore, in the non-updating target program call stop unit 152, the process of stopping the calling side (calling side updating target program PC11) that calls the non-updating target program PA11 is executed (step S12). Specifically, in the non-updating target program call stop unit 152, the process of stopping the calling side updating target program PC11 (see...) is executed. Figure 3 The process of pausing the non-updating target program PA11 is invoked. Here, when the non-updating target program PA11 is paused, the process of storing the context CA11 of the non-updating target program PA11 in the storage device (not shown) is run in the program update manager 15.

[0113] When the pause of the non-updating target program PA11 is completed, the non-updating target program calls the stop unit 152 to notify the communication management unit 151 of the completion of the pause. Then, the communication management unit 151 executes the process of reading the context CA11 of the non-updating target program PA11 from the storage device (not shown) and transmitting it to the update device (step S13). When the above process is completed, the communication management unit 151 executes the process of notifying the engineering facility 30 that the pause process has been completed (step S14).

[0114] like Figure 5 As shown, the process control device 20 (updating device) receives a message (request to restart) transmitted from the engineering facility 30 (step S21). Specifically, this message is received by the communication management unit 251 of the program update manager 25 provided in the process control device 20 (activation device). When the message transmitted from the engineering facility 30 is received, the communication management unit 251 outputs an instruction to restart the non-updating target program PA11 to the non-updating target program call stop unit 252.

[0115] Furthermore, the communication management unit 251 performs a process (step S22) to receive the context (context CA11 of the non-updating target program PA11) transmitted from the process control device 10 (active device). Then, the communication management unit 251 performs a process to store (copy) the received context in the same area (address) as the active device. As a result, the process control device 20 reproduces a state equivalent to the pause of the non-updating target program PA11.

[0116] When an instruction to restart the non-updating target program PA11 is input, the process of calling the activation program of the process control device 20 (updating device) is executed in the non-updating target program call restart unit 252 (step S23). When the activation program is called, the process of initializing the context is first executed in the context initialization control unit 253. Specifically, the context initialization control unit 253 determines whether the program to be initialized is a non-updating target program (step S24).

[0117] When it is determined that the program to be initialized is a non-updating target program (step S24: Yes), the process of bypassing the initialization process is executed in the context initialization control unit 253 (step S25). This avoids the initialization of the context (context CA11 of the non-updating target program PA11) stored (copied) in the same area (address) as the active device. On the other hand, when it is determined that the program to be initialized is not a non-updating target program (step S24: No), the process of allowing the initialization process to run is executed in the context initialization control unit 253 (step S26). Thus, the process of initializing the context of all updating target programs is executed.

[0118] When the initialization process is completed, the context initialization control unit 253 notifies the non-updating target program call restart unit 252 of the completion of the initialization process. When the context initialization control unit 253 notifies the completion of the initialization process and completes the activation process, the process of restarting the non-updating target program PA11 (non-updating target program PA21) is run in the non-updating target program call restart unit 252 (step S27).

[0119] When the restart of the non-updating target program PA11 (non-updating target program PA21) is completed, the non-updating target program calls the restart unit 252 to notify the communication management unit 251 of the completion of the restart process. When the notification is given, the communication management unit 251 runs the process of notifying the engineering facility 30 of the completion of the restart process (step S28). In this way, online updates are performed.

[0120] As described above, in the first exemplary embodiment, based on a pause request transmitted from the engineering facility 30, the non-updating target program PA11 (which is not the update target) is first paused in the process control device 10 (active device), and the context CA11 of the non-updating target program PA11 is transmitted to the process control device 20 (updating device). Then, based on a restart request transmitted from the engineering facility 30, the context CA11 of the non-updating target program PA21 (which is not the update target) is restored in the process control device 20 (updating device) using the transmitted context CA11; the context of the updated target program after the update is initialized; and both the non-updating target program and the updated target program are restarted. Thus, the updated target program can be updated simply and quickly while the process control system continues to operate without stopping the process control system.

[0121] [Second Exemplary Embodiment]

[0122] Configuration of process control system

[0123] Figure 6 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in a second exemplary embodiment of this disclosure. Furthermore, in Figure 6 In, with Figure 4 The configurations shown are denoted by the same reference numerals. Furthermore, the functional configuration of the entire process control system in the second exemplary embodiment is similar to that in the reference numerals. Figures 1 to 3 The functional configuration is described below. The differences from the first exemplary embodiment are primarily described in this description.

[0124] In the second exemplary embodiment, when an update target program (e.g., called from a non-updating target program PA11) is invoked... Figure 1 and Figure 2 While the processing of the target program PB11 (shown for updating) is in progress, the processing is quickly interrupted. At this time, the running position of the non-updating target program PA11 is set immediately before the request for updating the target program, so that the context of the non-updating target program PA11 is corrected. Furthermore, the information indicating that the updating target program is in progress is deleted to ensure the continued operation of the process control system 1.

[0125] like Figure 6 As shown, in the second exemplary embodiment, the program update manager 15A of the active device is configured such that a non-update target program stop position return unit 153 is added. Figure 4 The program update manager 15 of the active device is shown. Furthermore, the program update manager 25 of the update device has a similar function to... Figure 4 The configuration shown is the same.

[0126] When the non-updating target program calls the stop unit 152, it suspends the calling side update target program PC11 (see...). Figure 3 When the non-updating target program PA11 requests an update of the target program, the non-updating target program stop position return unit 153 determines whether the processing of the update request is in progress. If it is determined that the processing of the update request is in progress, the non-updating target program stop position return unit 153 sets the running position of the non-updating target program PA11 to the position immediately preceding the request for update processing. At this time, the non-updating target program stop position return unit 153 deletes the information indicating that the update of the non-updating target program PA11 is in progress.

[0127] <Program Update Method>

[0128] Figure 7 This is a flowchart depicting a program update method according to a second exemplary embodiment of the present disclosure. Figure 7 The flowchart shown depicts the process that will run in the non-updating target program stop position return unit 153 provided in the program update manager 15A. Figure 5 The process runs between steps S12 and S13. Figure 7 The flowchart shown illustrates the processing.

[0129] When running Figure 5 During step S12, the non-updating target program PA11 is paused. Specifically, the non-updating target program PA11 is paused immediately before it is called from the calling-side updating target program PC11, or immediately after it returns from the non-updating target program PA11 to the calling-side updating target program PC11. When the non-updating target program PA11 is paused, the non-updating target program call stop unit 152 notifies the non-updating target program stop position return unit 153 of the pause.

[0130] Then, the non-updating target program stop position return unit 153 determines whether the processing of the update target program requested by the non-updating target program PA11 is in progress (step S31). When it is determined that the processing requested by the non-updating target program PA11 is in progress (step S31: Yes), or when it is determined that it is uncertain (it cannot be determined whether the processing is in progress), subsequent processing is run in the non-updating target program stop position return unit 153. That is, processing that sets the running position of the non-updating target program to a position immediately preceding the processing of the requesting update target program that is in progress is run (step S32).

[0131] When the above processing is completed, the process of deleting the information held by the non-updating target program PA11 and indicating that the updating target program is in progress is executed (step S32) in the non-updating target program stop position return unit 153. This process is executed so that the information held by the non-updating target program PA11 becomes information immediately preceding the processing of the updating target program that is requesting ongoing processing. Furthermore, when the process of step S33 is executed, Figure 7 The process shown in the flowchart has ended.

[0132] Furthermore, if it is determined in step S31 that the processing of the non-updating target program PA11 request is not in progress (step S31: No), the process ends without running the steps S32 and S33. Figure 7 The flowchart shown illustrates the processing. When Figure 7 When the processing of the flowchart shown is completed, the non-updating target program stop position return unit 153 notifies the non-updating target program of the fact that it has called the stop unit 152.

[0133] Then, the process of transmitting the context CA11 of the non-updating target program PA11 to the process control device 20 is sequentially executed in the communication management unit 151. Figure 5 Step S13) and the notification to engineering facility 30 to suspend the completion of the process ( Figure 5 (Step S14 in the example). Furthermore, in the process control device 20, the process of restarting the non-updating target program PA11 (non-updating target program PA21) is run in a manner similar to that in the first exemplary embodiment.

[0134] As described above, in the second exemplary embodiment, when a non-updating target program PA11, which is not an update target, is paused in the process control device 10 (activity device) based on a pause request from the engineering facility 30, the following process is executed. First, the non-updating target program stop position return unit 153 determines whether the update target program is in progress. When the non-updating target program stop position return unit 153 determines that the update target program is in progress, a process is executed to set the running position of the non-updating target program PA11 to a position immediately preceding the request to process the update target program. At this time, the non-updating target program stop position return unit 153 deletes the information held by the non-updating target program PA11 that indicates the update target program is in progress.

[0135] Through the above processing, the process of non-updating target program PA11 requesting the updating target program is not executed, and the information maintained by non-updating target program PA11 and indicating the running position of non-updating target program PA11 and the status of the updating target program is set to a position immediately before the request for updating target program processing. Therefore, the updating target program can be updated in a short time while ensuring the continued operation of process control system 1.

[0136] [Third Exemplary Example]

[0137] Functional Configuration of Process Control System

[0138] Figure 8 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in a third exemplary embodiment of this disclosure. Figure 8 In, with Figure 4 The configurations shown are denoted by the same reference numerals. Furthermore, the functional configuration of the entire process control system in the third exemplary embodiment is similar to that in the reference numerals. Figures 1 to 3 The functional configuration is described below. The differences from the first exemplary embodiment are primarily described in this description.

[0139] The third exemplary embodiment is designed to wait for the processing to be fully completed while the processing of the update target program called from the non-updating target program PA11 is in progress. In the third exemplary embodiment, the context CA11 of the non-updating target program PA11 is transmitted to the update device in a state where the processing of the update target program called from the non-updating target program PA11 is fully completed. This ensures the continued operation of the process control system 1.

[0140] For example, in Figure 1 and Figure 2 In the illustrated case where the non-updating target program PA11 included in task 13 transmits a request to the updating target program PB12 included in task 14 via task-to-task communication provided by operating system 12 and is waiting for a response, consider pausing the invocation of the non-updating target program PA11. In the third exemplary embodiment, in this case, wait for all updating target programs, including the updating target program PB12, to complete their ongoing processing.

[0141] like Figure 8 As shown, in the third exemplary embodiment, the program update manager 15B of the active device is configured such that an update target program processing completion waiting unit 154 is added. Figure 4 The program update manager 15 of the active device is shown. Meanwhile, the program update manager 25 of the update device has a similar function to... Figure 4 The configuration shown is the same.

[0142] When a non-updating target program calls the stop unit 152 to pause the processing of the non-updating target program PA11, the update target program processing completion waiting unit 154 determines whether the update target program called from the non-updating target program PA11 is in progress. When it is determined that the update target program called from the non-updating target program PA11 is in progress, the update target program processing completion waiting unit 154 waits for all update target programs called from the non-updating target program PA11 to complete their ongoing processing. Simultaneously, the update target program processing completion waiting unit 154 can request the operating system 12 to determine whether the ongoing processing has been completed.

[0143] <Program Update Method>

[0144] Figure 9 This is a flowchart depicting a program update method according to a third exemplary embodiment of this disclosure. Meanwhile, Figure 9 The flowchart shown depicts the process that runs in the processing completion waiting unit 154 of the update target program provided in the program update manager 15B. Figure 5 The process runs between steps S12 and S13. Figure 9 The flowchart shown illustrates the processing.

[0145] When running Figure 5 During step S12, the non-updating target program PA11 is paused. Specifically, the non-updating target program PA11 is paused at a time immediately before it is called from the calling side update target program PC11 or immediately after it returns from the non-updating target program PA11 to the calling side update target program PC11. When the non-updating target program PA11 is paused, the non-updating target program calls the stop unit 152 to notify the update target program to perform the processing completion waiting unit 154 to acknowledge the pause.

[0146] Then, the update target program processing completion waiting unit 154 determines whether the processing of the update target program called by the non-updating target program PA11 is in progress (step S41). When it is determined that the processing is in progress (step S41: Yes) or when it is determined that it is uncertain (it cannot be determined whether the processing is in progress), the following process is run in the update target program processing completion waiting unit 154. That is, the process of waiting until all update target programs called by the non-updating target program PA11 complete their ongoing processing is run (step S42). At the same time, when the process of step S42 is run, Figure 9 The process shown in the flowchart has ended.

[0147] Furthermore, if it is determined in step S41 that the process is not in progress (step S41: No), the process ends without running the process in step S42. Figure 9 The flowchart shown illustrates the processing. When Figure 9 When the processing of the flowchart shown ends, the updating target program completes the processing and wait unit 154 notifies the non-updating target program to call the stop unit 152 to acknowledge this fact.

[0148] Then, the process of transmitting the context CA11 of the non-updating target program PA11 to the process control device 20 is sequentially executed in the communication management unit 151. Figure 5 Step S13) and the notification to engineering facility 30 to suspend the completion of the process ( Figure 5 (Step S14 in the example). At the same time, in the process control device 20, the process of restarting the non-updating target program PA11 (non-updating target program PA21) is run in a manner similar to that in the first exemplary embodiment.

[0149] As described above, in the third exemplary embodiment, when a non-updating target program PA11 (which is not an update target) is paused in the process control device 10 (activity device) based on a pause request transmitted from the engineering facility 30, the following process is executed. First, the update target program processing completion waiting unit 154 determines whether the processing of the update target program (the update target program called by the non-updating target program PA11) is in progress. When the update target program processing completion waiting unit 154 determines that the update target program is in progress, a process of waiting until all update target programs complete their ongoing processing is executed is run.

[0150] Through the above processing, once the processing of the update target program called from the non-updating target program PA11 is complete, the context CA11 of the non-updating target program PA11 is transmitted to the update device. Therefore, the update target program can be updated in a short time while ensuring the continued operation of the process control system 1.

[0151] [Fourth Exemplary Embodiment]

[0152] Functional Configuration of Process Control System

[0153] Figure 10 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in the fourth exemplary embodiment of this disclosure. Meanwhile, in Figure 10 In, with Figure 4 The configurations shown are denoted by the same reference numerals. Furthermore, the functional configuration of the entire process control system in the fourth exemplary embodiment is similar to that in the reference numerals. Figures 1 to 3 The functional configuration is described below. The differences from the first exemplary embodiment are primarily described in this description.

[0154] In the fourth exemplary embodiment, when an update target program invoked by a non-updating target program PA11 contains an update target program whose processing needs to be taken over by the update device, the takeover of the update target program's processing from the active device to the update device is enabled. In the fourth exemplary embodiment, to enable the takeover, in addition to the context CA11 of the non-updating target program PA11, recovery data necessary for restoring the context of the update target program whose processing needs to be taken over is extracted, and this recovery data is transmitted from the active device to the update device. Then, in the update device, the context of the update target program is restored using the transmitted recovery data.

[0155] like Figure 10 As shown, in the fourth exemplary embodiment, the program update manager 15C of the active device is configured such that an update target program processing reduction waiting unit 155 and an update target program context recovery data extraction unit 156 are added. Figure 4 The program update manager 15 of the active device is shown. Furthermore, the program update manager 25A of the update device is configured such that the update target program context recovery unit 254 is added. Figure 4 The program update manager 25 is shown.

[0156] When a non-updating target program calls the stop unit 152 to pause the processing of the non-updating target program PA11, the update target program processing reduction waiting unit 155 determines whether there is an update target program whose processing is in progress among the multiple update target programs called by the non-updating target program PA11. If the update target program processing reduction waiting unit 155 determines that there is even one update target program whose processing is in progress, it performs the following processing.

[0157] In other words, the update target program performs processing reduction waiting unit 155 to set up ongoing processing in multiple update target programs that aggregate calls from non-updating target program PA11, specifically for update target programs whose specifications have been published (pre-registered update target programs). Specifically, it sets up so that requests for update target programs whose specifications have been published are not transmitted to other update target programs. Then, it waits for the update target program's processing to stop. "Update target programs whose specifications have been published" refers to system calls, public libraries, etc., whose specifications are explicitly defined and published.

[0158] When the update target program processing reduction waiting unit 155 confirms that the update target program processing has stopped, it requests the update target program context recovery data extraction unit 156 to extract recovery data. Simultaneously, when the update target program context recovery data extraction unit 156 notifies that the extraction of recovery data is complete, the update target program processing reduction waiting unit 155 notifies the non-updating target program call stop unit 152 that the extraction is complete.

[0159] When the processing reduction waiting unit 155 requests the extraction of recovery data from the updated target program, the updated target program context recovery data extraction unit 156 performs the process of extracting the recovery data required for the recovery context from the context of the updated target program whose specification has been published. When the extraction of recovery data is completed, the updated target program context recovery data extraction unit 156 notifies the updated target program processing reduction waiting unit 155 that the extraction is complete.

[0160] When the context initialization control unit 253 requests context restoration, the update target program context restoration unit 254 restores the context of the updated target program whose specifications have been published by using restoration data transmitted from the active device and the published processing request procedure. When context restoration is complete, the update target program context restoration unit 254 notifies the context initialization control unit 253 that restoration is complete.

[0161] Here, consider an example where the published specification for the update target program's function is inter-task communication, and the context to be restored is a mailbox (accumulated unread messages in inter-task communication) obtained as a result of the processing of inter-task communication. In this example, for the inter-task communication function, the update target program's processing reduction waiting unit 155 sets a setting that allows saving newly transmitted messages but prevents the update target program from reading accumulated unread messages, thereby waiting for the update target program's processing to stop. For example, this setting is implemented by the update target program's processing reduction waiting unit 155 requesting the operating system 12 to stop the system calls used to extract requests from inter-task communication.

[0162] For example, when communication between tasks is Figure 2 When updating target program PB13, the processing reduction waiting unit 155 is configured to prevent requests for updating target program PB13 from being transmitted to updating target programs PB12 and PB14. Simultaneously, updating target programs PB12 and PB14 can request updating target program PB13 to run its processing. After this configuration, the processing reduction waiting unit 155 waits for the updating target program's processing to stop.

[0163] In this example, the items of the recovery data to be extracted by the target program context recovery data extraction unit 156 are within the scope defined in the mailbox's functional specifications, and are illustrated below. As a first example, the recovery data includes the mailbox's generation information. The mailbox's generation information includes the maximum number of messages to be stored and an upper limit size for each message (e.g., number of bytes). And, as a second example, the recovery data is the transmission information (sending task ID, destination task ID, date and time, urgency, and message body) for a single message (only unread messages).

[0164] When recovery data is transmitted from the active device to the update device, processing is performed in the update target program context recovery unit 254 to generate a mailbox based on the first recovery data instead of a corresponding task. Furthermore, on the update device side, processing is performed to transmit messages based on the second recovery data instead of a corresponding task, and to sequentially accumulate messages in the mailbox.

[0165] <Program Update Method>

[0166] Figure 11 and Figure 12 This is a flowchart depicting a program update method according to a fourth exemplary embodiment of the present disclosure. Meanwhile, Figure 11 The flowchart shown depicts the processes that will run in the processing reduction waiting unit 155 and the update target program context recovery data extraction unit 156, which are part of the update target program provided by the program update manager 15C. Figure 5 The process runs between steps S12 and S13. Figure 11 The flowchart shown illustrates the processing. Furthermore, Figure 12 The flowchart shown depicts the process that will run in the update target program context recovery unit 254 provided in the program update manager 25A. Figure 5 The process runs between steps S26 and S27. Figure 12 The flowchart shown illustrates the processing.

[0167] When running Figure 5 During step S12, the non-updating target program PA11 is paused, and the non-updating target program calls the stop unit 152 to notify the updating target program to process the waiting reduction unit 155 to stop the pause. Then, the updating target program processing waiting reduction unit 155 determines whether there is an updating target program whose processing is in progress among the multiple updating target programs called by the non-updating target program PA11 (step S51).

[0168] When it is determined that there is even one update target program whose processing is in progress (step S51: Yes), the update target program processing reduction waiting unit 155 performs the following processing; or when it is determined that it is uncertain (it cannot be determined whether processing is in progress), the update target program processing reduction waiting unit 155 performs the following processing. That is, the update target program processing reduction waiting unit 155 performs a setting process so that requests for update target programs whose specifications have been published are not transmitted to other update target programs (step S52).

[0169] When the above settings process is completed, the update target program processing reduction waiting unit 155 waits until the processing of all update target programs called by non-update target program PA11 stops (step S52). When it is confirmed that the processing of all update target programs called by non-update target program PA11 has stopped, the update target program processing reduction waiting unit 155 requests the update target program context recovery data extraction unit 156 to extract the recovery data.

[0170] When a request to extract recovery data is issued, the update target program context recovery data extraction unit 156 performs the process of extracting the recovery data required for the recovery context from the context of the stopped update target program (the update target program whose specification has been published) (step S54). When the extraction of recovery data is completed, the update target program context recovery data extraction unit 156 notifies the update target program to process the reduction waiting unit 155 to complete the extraction.

[0171] When the update target program context recovery data extraction unit 156 notifies that extraction is complete, the update target program processing reduction waiting unit 155 notifies the non-updating target program call stop unit 152 of this fact (extraction complete). Then, the recovery data extracted by the update target program context recovery data extraction unit 156 is transmitted to the update device via the communication management unit 151 (step S55). When the above processing is performed, Figure 11 The process shown in the flowchart ends. On the other hand, if it is determined in step S51 that there is no update target program whose processing is in progress (step S51: No). Figure 11 The process shown in the flowchart has ended.

[0172] Then, the process of transmitting the context CA11 of the non-updating target program PA11 to the process control device 20 is sequentially executed in the communication management unit 151. Figure 5 Step S13) and the notification to engineering facility 30 to suspend the completion of the process ( Figure 5 Step S14 in the process.

[0173] When the request to transfer data from engineering facility 30 to the update device is restarted, similar to the first exemplary embodiment, operation... Figure 5 The processes shown are steps S21 to S26. Here, when the process of step S26 ends, the context initialization control unit 253 requests the target program context recovery unit 254 to restore the context. Then, the target program context recovery unit 254 performs the process of receiving the restored data via the communication management unit 251 (step S61).

[0174] Then, the target program context recovery unit 254 performs a process to recover the context of the updated target program whose specification has been published by using the received recovery data and the published processing request process (step S62). When the context recovery is complete, the target program context recovery unit 254 notifies the context initialization control unit 253 that the recovery is complete.

[0175] Then, the non-updating target program calls the restart unit 252 to run the process of restarting the non-updating target program PA11 (non-updating target program PA21). Figure 5 Step S27). When the restart of the non-updating target program PA11 (non-updating target program PA21) is completed, the non-updating target program calls the restart unit 252 to notify the communication management unit 251 of the completion of the restart process. When the notification is made, the communication management unit 251 notifies the engineering facility 30 of the completion of the restart process. Figure 5 Step S28 in the process.

[0176] As described above, in the fourth exemplary embodiment, when it is determined that there is an update target program whose processing is in progress among the update target programs called by the non-updating target program PA11, the active device sets itself such that requests for update target programs whose specifications have been published are not transmitted to other update target programs, and waits for the processing of the update target program to stop. Then, recovery data required to restart processing is extracted from the context of the update target program whose specifications have been published.

[0177] Furthermore, in the fourth exemplary embodiment, the updating device restores the context of the updating target program (the updating target program whose specification is published) after the update by using recovery data transmitted from the active device. Then, when the context restoration is complete, the invocation of the non-updating target program PA11 (PA21) is restarted.

[0178] Through the above processing, in addition to the context CA11 of the non-updating target program PA11 on the active device side, the context of the updated target program whose specification has been published can also be restored in the updated target program called from the non-updating target program PA11 on the updating device side. Therefore, even if there is an updated target program on the updating device side whose processing needs to be taken over by the updated target program called from the non-updating target program PA11, the updated target program can be updated in a short time while ensuring the continued operation of the process control system 1.

[0179] [Fifth Exemplary Embodiment]

[0180] Figure 13 This is a functional configuration diagram depicting an illustrative functional configuration of a process control system according to a fifth exemplary embodiment of the present disclosure. Figure 13 In, with Figure 1 and Figure 2 The configurations shown are denoted by the same reference numerals. Furthermore, in Figure 13 Only the functional configuration required to describe the fifth exemplary embodiment is shown in the text. Therefore, in Figure 13 In, for example, not shown Figure 1 The process control device 10, engineering facilities 30, etc., are shown. Meanwhile, in the fifth exemplary embodiment, program update managers 15 and 25 respectively provide... Figure 4 The active device and the updating device shown are described below. The differences from the second exemplary embodiment will be primarily described in the following description.

[0181] In the second exemplary embodiment, considering only the process control device 10, the processing is quickly interrupted when processing an updated target program called from a non-updating target program PA11 is in progress. Here, when a communication partner device 40 (other device) configured to communicate with the process control device 10 is present, considering that requests are made to the process control device 10 from the communication partner device 40 in addition to the calls (requests) from the non-updating target program PA11, the ongoing communication processing needs to continue to prevent problems such as communication errors from occurring.

[0182] The reason is that the pause in the process control device 10 is not perceived by the ongoing communication processing. That is, even when the process control device 10 is paused, the communication partner device 40 perceives that the process control device 10 is continuing to operate. In the fifth exemplary embodiment, even when the communication partner device 40 is present, the communication partner device 40 is not perceived by the pause in the process control device 10, so that the target program can be updated in a short time while ensuring the continued operation of the process control system 1.

[0183] like Figure 13As shown, the operating system 12 has an update target program PB16 as one of the update target programs. The update target program PB16 is a communication driver configured to enable communication between a task operating on the operating system 12 (e.g., task 13) and a task operating on the communication partner device 40 (e.g., task 42 operating on the operating system 41 of the communication partner device 40). In the fifth exemplary embodiment, a request / response protocol is installed on the communication driver, enabling request transmission acknowledgment / retransmission and reception deduplication between the requesting task (as the source of the request) and the response task (as the destination of the processing).

[0184] In a request / response protocol, the requesting task assigns a communication data ID to the communication data and transmits it, while the responding task assigns and replies with a communication data ID. The communication data ID is an identifier used to uniquely identify the communication data and is, for example, a serial number. Communication functions with request / response protocols include Vnet's GET communication, FF (Foundation Fieldbus Association) client-server communication, PROFIBUS (Registered Trademark) DP-V1 communication, etc.

[0185] Figure 14 A request / response protocol that will be used in a fifth exemplary embodiment of this disclosure is illustrated. For example... Figure 14 As shown, in the request / response protocol, when process control device 10 (task 13) transmits a (notification) request to communication partner device 40 (task 42), process control device 10 (task 13) waits for a response from communication partner device 40 (task 42). When the processing of the request (first predetermined processing) is completed, communication partner device 40 (task 42), which has received the request, replies (notifies) a response indicating the result of the processing. When process control device 10 (task 13), which has transmitted the request, receives the response from communication partner device 40 (task 42), the ongoing processing is completed.

[0186] Conversely, when the communication partner device 40 (task 42) transmits a request to the process control device 10 (task 13), the communication partner device 40 (task 42) waits for a response from the process control device 10 (task 13). When the processing of the request (the second predetermined processing) is completed, the process control device 10 (task 13), which has received the request, replies with a response indicating the result of the processing.

[0187] Here, when using a common general communication protocol (e.g., TCP / IP), when a request from communication partner device 40 is normally received by process control device 10, an acknowledgment (ACK) is sent from process control device 10 to communication partner device 40 even if the processing requested from communication partner device 40 has not yet ended in process control device 10. Conversely, when using a request / response protocol, a response is sent from process control device 10 to communication partner device 40 only after the processing requested from communication partner device 40 has ended in process control device 10. That is, when using a common general communication protocol, highly reliable communication is implemented between communication drivers. However, when using a request / response protocol, highly reliable communication is implemented on all paths of interconnecting request and response tasks.

[0188] Here, when an active device is operating within an online update response task, the online update may lose response data. Even in this case, because the communication driver of the request task monitors the reception of response data via the request / response protocol, it retransmits the request data for the response data if no response data is received within a predetermined time. As a result, since the lost response data is recovered, the request task of the communication partner device can remain unaware of the online update even when an active device is operating within an online update response task.

[0189] Conversely, when an online update request task is being performed on an active device, request data may be lost due to the online update. In this case, the lost request data cannot be recovered in the request / response protocol. Therefore, if the request task has already transmitted request data to the response task and the update target program is in progress, when the online update is paused, the stop position of the non-updating target program PA11 is returned to the state immediately preceding the time the request was transmitted to the update target program (the state before the update target program was in progress). Thus, the lost request data is recovered.

[0190] As described above, in the fifth exemplary embodiment, communication is performed using a request / response protocol between the process control device 10 and the communication partner device 40. Therefore, if no response is received within a predetermined time, the request for a response is retransmitted. As a result, even in the presence of the communication partner device 40, the target program can be updated quickly while ensuring the continued operation of the process control system 1.

[0191] [Sixth Exemplary Embodiment]

[0192] Functional Configuration of Process Control System

[0193] Figure 15This is a functional configuration diagram depicting an illustrative functional configuration of a process control system according to a sixth exemplary embodiment of the present disclosure. Figure 15 In, with Figure 1 , Figure 2 and Figure 13 The configurations shown are denoted by the same reference numerals. Furthermore, in Figure 15 Only the functional configuration required to describe the sixth exemplary embodiment is shown in the text. Therefore, in Figure 15 In, for example, not shown Figure 1 The process control device 10, engineering facilities 30, etc., are shown. The following description will primarily focus on the differences from the first exemplary embodiment.

[0194] The third exemplary embodiment is designed such that, when considering only the process control device 10, while processing an update target program called from a non-updating target program PA11 is in progress, the process waits for the processing to be fully completed. After all processing is completed, the context CA11 of the non-updating target program PA11 is transmitted to the update device, thereby ensuring the continued operation of the process control system 1.

[0195] Here, when the communication partner device 40 is configured to perform communication with the process control device 10, after the non-updating target program PA11 is paused, it is necessary not to receive new requests from the communication partner device 40. This is to reduce the ongoing processing in the communication process to zero. That is, when there is no new request from the communication partner device 40, if a response to the received request is given, the ongoing processing ends. Furthermore, the invocation of the non-updating target program PA11 is also stopped. However, processing of requests that have already been made ends upon receiving a response. In this way, in the sixth exemplary embodiment, even if the communication partner device 40 is present, no new requests are received from the communication partner device 40, but a response is received, allowing the update target program to be updated in a short time while ensuring the continued operation of the process control system 1.

[0196] like Figure 15 As shown, the operating system 12 has update target programs PB17 and PB18 as update target programs. Update target program PB17 provides communication functionality between tasks operating on the operating system 12 (e.g., tasks 13 and 14). Update target program PB18 is a communication driver configured to enable communication between tasks operating on the operating system 12 (e.g., task 14) and communication partner device 40.

[0197] The communication driver (update target program PB18) is configured to perform communication using a common communication protocol (e.g., TCP / IP). When the communication driver (update target program PB18) performs communication using TCP / IP, message delivery acknowledgment / retransmission and deduplication are performed. That is, the communication driver (update target program PB18) waits for acknowledgment (ACK) while transmitting data, retransmits data if no acknowledgment is received, and eliminates duplicate data when it is received.

[0198] On operating system 12, tasks 13 and 14 are performed. In task 13, the non-updating target program PA11 operates similarly. Figure 13 Task 13 is shown. In Task 14 (Use Task), the target program PB12 is updated. The target program PB12 is used as the interface for the target program PB18. That is, the non-updating target program PA11 of Task 13 can access the target program PB18 (communication driver) via the target program PB17 (inter-task communication) and the target program PB12 (relay task).

[0199] Therefore, the non-updating target program PA11 of Task 13 can perform bidirectional communication with the communication partner device 40 via the updating target program PB17 (inter-task communication), the updating target program PB12 (relay task), and the updating target program PB18 (communication driver). Specifically, for example, the non-updating target program PA11 of Task 13 can perform bidirectional communication with Task 42, which operates on the operating system 41 of the communication partner device 40. Simultaneously, a common communication protocol such as TCP / IP between Task 13 and Task 42 is used to perform the communication.

[0200] Meanwhile, the non-updating target program PA11 operating on task 13 has context CA11. The updating target program PB12 operating on task 14 has context CB12. Furthermore, the updating target program PB17 of operating system 12 has context CB17, and the updating target program PB18 has context CB18.

[0201] Figure 16 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in the sixth exemplary embodiment of this disclosure. Figure 16 In, with Figure 8 The configurations shown are denoted by the same reference numerals. For example... Figure 16 As shown, in the sixth exemplary embodiment, the program update manager 15D on the active device side is configured such that a communication receive port blocking unit 157 is added. Figure 8The program update manager 15B on the active device side is shown. Meanwhile, the program update manager 25 on the update device side has the same... Figure 8 Same configuration.

[0202] The communication receive port blocking unit 157 is configured to block the receive port of the communication driver (e.g., Figure 15 The update target program PB18 shown prevents requests for new processing from external devices (e.g., communication partner device 40). When a request to stop the non-updating target program is received from the call stop unit 152, the communication receive port blocking unit 157 immediately blocks the receive port of the communication driver. The request communication receive port blocking unit 157 requests the start of processing via the call stop unit 152 before the update target program completes the processing wait unit 154. For example, the communication receive port blocking unit 157 blocks the receive port of the communication driver, and this communication receive port blocking unit 157 uses the functions of the operating system 12 to operate the receive interrupt mask.

[0203] Furthermore, when the communication driver performs communication using a common communication protocol, even if the receiving port of the communication driver is temporarily blocked, data loss can be prevented when communication resumes during the retransmission period. The "retransmission period" is a time period of length obtained by multiplying the number of retransmissions N by the waiting time (response waiting time) Tw, where the waiting time Tw is the time from when a request is transmitted until the next request is transmitted.

[0204] <Program Update Method>

[0205] Figure 17 This is a flowchart depicting a program update method according to a sixth exemplary embodiment of the present disclosure. Meanwhile, Figure 17 The flowchart shown depicts the process executed by the update target program provided in the program update manager 15D, including the completion waiting unit 154 and the communication receive port blocking unit 157. Figure 5 The process runs between steps S12 and S13. Figure 17 The flowchart shown illustrates the processing.

[0206] When running Figure 5During step S12, the non-updating target program PA11 is paused. Specifically, the non-updating target program PA11 is paused at a timing immediately before it is called from the calling-side updating target program PC11 or immediately after it returns to the calling-side updating target program PC11. When the non-updating target program PA11 is paused, the non-updating target program call stop unit 152 requests the communication receive port blocking unit 157 to begin processing. Then, the communication receive port blocking unit 157 immediately runs the process of blocking the receive port of the communication driver, causing the communication driver ( Figure 15 The update target program PB18 shown does not accept requests for new processing (step S71).

[0207] When the process of blocking the receive port of the communication driver is completed, the communication receive port blocking unit 157 notifies the non-updating target program call stop unit 152 that the process is complete. When the communication receive port blocking unit 157 notifies that the process is complete, the update target program requesting the update target program to process completion waiting unit 154 from the non-updating target program call stop unit 152 begins processing. Then, the update target program processing completion waiting unit 154 determines whether the processing of the update target program called by the non-updating target program PA11 and the update target program called by the request from the communication partner device 40 is in progress (step S72).

[0208] When it is determined that processing is in progress (step S72: Yes), the update target program processing completion waiting unit 154 runs the following process. That is, it runs the process of waiting until the update target program called by the non-updating target program PA11 and the update target program called by the request from the communication partner device 40 complete the ongoing processing (step S73). At the same time, when the process of step S73 is run, Figure 17 The process shown in the flowchart has ended.

[0209] Furthermore, if it is determined in step S72 that the process is not in progress (step S72: No), the process ends without running the process in step S72. Figure 17 The flowchart shown illustrates the processing. When Figure 17 When the processing of the flowchart shown ends, the updating target program completes the processing and wait unit 154 notifies the non-updating target program to call the stop unit 152 to acknowledge this fact.

[0210] Then, the process of transmitting the context CA11 of the non-updating target program PA11 to the process control device 20 is sequentially executed in the communication management unit 151. Figure 5 Step S13) and the notification to engineering facility 30 to suspend the completion of the process ( Figure 5(Step S14 in the example). At the same time, in the process control device 20, the process of restarting the non-updating target program PA11 (non-updating target program PA21) is run in a manner similar to that in the first exemplary embodiment.

[0211] As described above, in the sixth exemplary embodiment, when a non-updating target program PA11, which is not an update target, is paused in the process control device 10 (active device), the following process is executed based on the pause request from the engineering facility 30. First, the communication receive port blocking unit 157 operates to block the communication driver ( Figure 18 The processing of the receive port of the update target program (PB18) shown.

[0212] Then, the update target program processing completion waiting unit 154 determines whether the processing of the update target program called by the non-updating target program PA11 and the update target program called by the request from the communication partner device 40 is in progress. When the update target program processing completion waiting unit 154 determines that the processing of the update target program is in progress, it waits until all update target programs have completed their ongoing processing.

[0213] Through the above processing, the context CA11 of the non-updating target program PA11 is transmitted to the updating device after the processing of both the updating target program called by the non-updating target program PA11 and the updating target program called by the request from the communication partner device 40 is completed. Therefore, even in the presence of the communication partner device 40, the updating target program can be updated quickly while ensuring the continued operation of the process control system 1.

[0214] [Seventh Exemplary Example]

[0215] Functional Configuration of Process Control System

[0216] Figure 18 This is a functional configuration diagram depicting an illustrative functional configuration of a process control system according to a seventh exemplary embodiment of the present disclosure. Figure 18 In, with Figure 15 The configurations shown are denoted by the same reference numerals. Furthermore, in Figure 18 Only the functional configuration required to describe the seventh exemplary embodiment is shown in the text. Therefore, in Figure 18 In, for example, not shown Figure 1 The process control device 10, engineering facilities 30, etc., are shown. The following description will primarily focus on the differences from the fourth exemplary embodiment.

[0217] In the fourth exemplary embodiment, considering only the process control device 10, when an update target program called by the non-updating target program PA11 has an update target program whose processing needs to be taken over by the update device, the processing of the update target program is taken over from the active device to the update device. Here, similar to the sixth exemplary embodiment, when there is a communication partner device 40 configured to perform communication with the process control device 10, it is not necessary to receive new requests from the communication partner device 40 after the non-updating target program PA11 is suspended. In the seventh exemplary embodiment, even if the communication partner device 40 is present, no new requests are received from the communication partner device 40, so that the update target program can be updated in a short time while ensuring the continued operation of the process control system 1.

[0218] like Figure 18 As shown, in addition to update target programs PB17 and PB18, operating system 12 also has update target program PB19 as an update target program. Update target program PB19 provides communication functionality between tasks operating on operating system 12 (inter-task communication function), similar to update target program PB17. Meanwhile, in Figure 18 In the context of updating target programs PB17 and PB19, the context is shown together as context CB17.

[0219] The non-updating target program PA11 of Task 13 can perform bidirectional communication with the communication partner device 40 via the updating target program PB17 (inter-task communication), updating target program PB12 (relay task), updating target program PB19 (inter-task communication), and updating target program PB18 (communication driver). Meanwhile, communication between Task 14 and Task 42 of the communication partner device 40 is performed using a common communication protocol such as TCP / IP.

[0220] Figure 19 This is a functional block diagram depicting the detailed functional configuration of the program update manager (active device side and update device side) in the seventh exemplary embodiment of this disclosure. Figure 19 In, with Figure 10 The configurations shown are denoted by the same reference numerals. For example... Figure 19 As shown, in the seventh exemplary embodiment, the program update manager 15E of the active device is configured such that a communication receive port blocking unit 157 is added. Figure 10 The program update manager 15C of the active device is shown. Meanwhile, the program update manager 25 of the update device has a similar function to... Figure 10 The configuration shown is the same.

[0221] Communication receive port blocking unit 157 is similar to Figure 16The communication receive port blocking unit shown is used. That is, when a request to stop the call to the stop unit 152 from a non-updating target program occurs, the communication receive port blocking unit 157 immediately blocks the communication driver (e.g., Figure 18 The receive port of the update target program (PB18) shown is blocked so that requests for new processing are not received from external devices (e.g., communication partner device 40). Simultaneously, for example, the communication receive port blocking unit 157 blocks the receive port of the communication driver, which uses the functions of the operating system 12 to operate the receive interrupt mask.

[0222] <Program Update Method>

[0223] Figure 20 This is a flowchart depicting a program update method according to a seventh exemplary embodiment of the present disclosure. Meanwhile, Figure 20 The flowchart shown depicts the process of running the waiting reduction unit 155, the update target program context recovery data extraction unit 156, and the communication receive port blocking unit 157, which are processed by the update target program provided in the program update manager 15E. Figure 5 The process runs between steps S12 and S13. Figure 20 The flowchart shown illustrates the processing.

[0224] When running Figure 5 During step S12, the non-updating target program PA11 is paused. Specifically, the non-updating target program PA11 is paused at a timing immediately before it is called from the calling-side updating target program PC11 or immediately after it returns to the calling-side updating target program PC11. When the non-updating target program PA11 is paused, the non-updating target program call stop unit 152 requests the communication receive port blocking unit 157 to begin processing. Then, the communication receive port blocking unit 157 immediately runs the process of blocking the receive port of the communication driver, causing the communication driver ( Figure 15 The update target program PB18 shown does not accept requests for new processing (step S81).

[0225] When the process of blocking the receive port of the communication driver is completed, run with Figure 11 The processing shown in the flowchart is similar to the processing in steps S51 to S55. Meanwhile, in Figure 18 In the functional block, the update target programs whose specifications are published are update target programs PB17 and PB19 (communication between tasks). Therefore, in the processing of step S52, the update target programs perform processing to reduce waiting unit 155 and run the following processing.

[0226] That is, the settings are configured to prevent requests for updating target program PB17 (inter-task communication) from being transmitted to the processing of non-updating target program PA11 and updating target program PB12 (relay task). Furthermore, the settings are configured to prevent requests for updating target program PB19 (inter-task communication) from being transmitted to the processing of non-updating target program PA12 (relay task) and updating target program PB18 (communication driver).

[0227] when Figure 20 When the process shown in the flowchart ends, the process of transmitting the context CA11 of the non-updating target program PA11 to the process control device 20 is sequentially executed in the communication management unit 151. Figure 5 Step S13) and the notification to engineering facility 30 to suspend the completion of the process ( Figure 5 (Step S14 in the process control device 20). Furthermore, in the process control device 20, the process of restarting the non-updating target program PA11 (non-updating target program PA21) is run in a manner similar to that in the fourth exemplary embodiment.

[0228] As described above, in the seventh exemplary embodiment, when a non-updating target program PA11, which is not an update target, is paused in the process control device 10 (activity device) based on a pause request from the engineering facility 30, the communication receive port blocking unit 157 blocks the communication driver ( Figure 18 The target program PB18 (as shown) is updated via its receiving port, and then a process similar to that in the fourth exemplary embodiment is run. Thus, even in the presence of the communication partner device 40, the target program can be updated quickly while ensuring the continued operation of the process control system 1.

[0229] [Application Examples of Process Control Systems]

[0230] Figure 21 This is a block diagram illustrating an example of a process control system according to exemplary embodiments of the present disclosure applied to a system configured to control an industrial process. Figure 21 As shown, process control unit 10 (active device) and process control unit 20 (updating device) are connected to multiple field devices FD via network N1. Field devices FD are devices configured to measure and control various states in an industrial process, such as a plant. Specifically, field devices FD are, for example, sensors such as flow meters, thermometers, hygrometers, and pressure gauges, or devices such as valves, pumps, and actuators. Furthermore, process control units 10 and 20 are connected to engineering facility 30 via network N2.

[0231] The non-updating target program PA11, installed in process control devices 10 and 20, receives data (process values) collected from the field device FD and is configured to perform calculations such as PID control, sequential control, and simulation processing. PA11 is configured to operate the field device FD based on the calculation and processing results, enabling it to execute outputs from other control devices. At this time, PA11 can call the updated target program to utilize functions provided by the operating system 12, etc. In this way, process control devices 10 and 20 grasp the state of the industrial process and control it to the desired state.

[0232] The following describes the processing of the update target program for the updated process control device. First, process control device 10 operates as the active device, and process control device 20 is on standby as the update device. At this time, process control device 10 controls the industrial process via field device FD. The context used for process control is stored only in process control device 10 as the active device and is appropriately overwritten.

[0233] Then, in order to update the target program, the updated target program is installed (updated) in the process control device 20, which serves as the update device, and necessary tests are performed. After installation and testing are completed, the active device and the update device are switched at an appropriate time.

[0234] Specifically, the engineering facility 30 commands the process control device 10 to pause. The program update manager 15 of the process control device 10 stops both the non-updating target program PA11 and the updating target program according to the instructions from the engineering facility 30. At this time, the program update manager 15 transmits the context CA11 of the non-updating target program PA11 to the program update manager 25 of the process control device 20, which acts as an update device. Furthermore, when it is necessary to restore the context of the updating target program, the program update manager 15 extracts the restoration data and transmits it to the program update manager 25 of the process control device 20.

[0235] After process control device 10 stops, there is a period of time during which both active and replacement devices are temporarily inactive. The length of this period is within a pre-designed (predefined) predetermined time so as not to affect industrial process control, and the industrial process continues even during this period.

[0236] The program update manager 25 receives takeover data (context CA11, recovery data) transmitted from the program update manager 15 according to instructions from the engineering facility 30. Based on the takeover data, the program update manager 25 restores the context in the process control unit 20 and activates the non-updating target program PA21 and the updated target program. The non-updating target program PA21 and the updated target program in the process control unit 20 restart the control of the industrial process based on the restored context. After restoration, the process control unit 20 functions as an active device.

[0237] Meanwhile, as described above, the program update manager 25 can perform corresponding operations based on messages from the program update manager 15, rather than receiving takeover data and activating the non-update target program PA21 and the update target program based on instructions from the engineering facility 30. In this case, the engineering facility 30 does not transmit a message requesting restart to the program update manager 25. Instead, the program update manager 15 also notifies the program update manager 25 of a pause completion message.

[0238] [Process control device]

[0239] Figure 22 This is a functional block diagram illustrating a schematic functional configuration of a process control apparatus according to another exemplary embodiment of this disclosure. Figure 22 In, with Figure 1 The configurations shown are denoted by the same reference numerals. In the first to seventh exemplary embodiments, two process control devices 10 and 20 are used to perform program updates and transfer operations of the process control devices. In contrast, in this exemplary embodiment, only one process control device 50 is used to perform program updates, etc.

[0240] like Figure 22 As shown, the process control device 50 in the exemplary embodiment includes hardware 51 and a management program 52 (program execution unit). The hardware 51 includes a CPU, memory, input / output devices, communication devices, etc. Figure 1 The hardware 11 and 21 shown are configured to run various programs (including non-updating target programs and updating target programs) to be used in the process control device 50.

[0241] The management program 52 is configured to operate virtually on hardware 51 as a replacement for the hardware, and is provided to operate operating system 12, task 13, program update manager 15, operating system 22, task 23, and program update manager 25 independently. That is, the management program 52 is provided to operate independently within a process control device 50. Figure 1 The functions operated in the process control device 10 and the functions operated in the process control device 20 are shown.

[0242] In this way, the exemplary embodiment differs from the various exemplary embodiments in that the functions operating in process control device 10 and the functions operating in process control device 20 operate independently in a single process control device 50, and program updates, etc., are performed in a manner similar to the various exemplary embodiments. For this reason, a detailed description thereof is omitted herein.

[0243] As described above, when using any of the exemplary embodiments, the update target program of the process control device in the online state can be updated without interrupting the industrial process.

[0244] Furthermore, as described above, the functions of at least some of the process control devices, engineering facilities, field control stations, and field equipment in the various exemplary embodiments can be implemented by a computer. In this case, the program for implementing the functions can be recorded in a computer-readable recording medium, and the program recorded in the recording medium can be read and executed by a computer system.

[0245] "Computer system" includes the operating system and hardware such as peripheral devices. Furthermore, "computer-readable recording medium" refers to portable media such as floppy disks, magneto-optical disks, ROMs, CD-ROMs, DV-ROMs, USB storage devices, or storage devices such as hard disks integrated into a computer system. Additionally, "computer-readable recording medium" can include media configured to dynamically store programs for short periods, such as communication lines used when programs are transmitted via networks such as the Internet or communication channels such as telephone lines, and media configured to store programs for predetermined periods, such as volatile memory within server or client computer systems used in this context. Furthermore, a program can be a program used to implement a portion of the aforementioned functions, or a program capable of implementing functions in conjunction with programs already recorded in the computer system.

[0246] A process control system, process control apparatus, and program update method according to exemplary embodiments of the present disclosure have been described. However, the present disclosure is not limited to exemplary embodiments and can be modified arbitrarily within the scope of the present disclosure. For example, the multiple exemplary embodiments may be combined and implemented within the scope where multiple exemplary embodiments can be combined.

[0247] For example, in Figure 22 In the process control device 50 shown, instead of the combination of program update managers 15 and 25, the following combination can also be used. That is, the following combination can be used: Figure 6 The combination of Program Update Managers 15A and 25 shown is shown. Figure 8 The combination of Program Update Manager 15B and 25 shown, and Figure 10 The example shown is a combination of Program Update Manager 15C and 25A. Furthermore, it can also be used... Figure 16 The combination of Program Update Manager 15D and 25 shown, and Figure 19 The combination shown is for Program Update Manager 15E and 25A.

[0248] Furthermore, the configuration of the process control system and process control device has been described in several exemplary embodiments. However, the configuration of the exemplary embodiments can be applied to any other system. In this case, preferably, the program corresponding to the non-updating target program PA11 in the exemplary embodiments updates the target program PC11 from the calling side in the exemplary embodiments (see [link to example]). Figure 3 The corresponding program is invoked within a predetermined time period and performs the predetermined calculations.

[0249] Furthermore, in several exemplary embodiments, the operating system may be an installation OS for controlling an installed system, or a general-purpose OS for controlling a general-purpose computer. Also, in exemplary embodiments, the unit of execution of processing managed under the operating system is referred to as a "task." However, even when "processing" is used instead of "task," the configuration of the exemplary embodiments can still be applied.

Claims

1. A process control system, comprising: First process control device; as well as Second process control device, The first process control device includes: The first program execution unit is configured to run a non-update target program that is not the update target and an update target program that can be the update target; and The first program update manager is configured to pause the non-updating target program based on a pause request from an external source, and to transmit the context of the non-updating target program to the second process control device. The second process control device includes: The second program execution unit is configured to run the non-updating target program (which is not the update target) and the updated target program (after the update); and The second program update manager is configured to restore the context of the non-updating target program using the context transmitted from the first program update manager, initialize the context of the updating target program, and cause the second program execution unit to restart the non-updating target program and the updating target program based on a restart request from the external source. Wherein, when it is determined that among the update target programs called by the non-update target program, there is an update target program that is currently being processed, the first program update manager is configured as follows: Configure settings to prevent requests from pre-registered update target programs in the update target program from being sent to other update target programs; Wait for the processing of the target program to stop; After the processing of the update target program stops, the recovery data required to restart processing is extracted from the context of the pre-registered update target program; and The extracted recovery data is transmitted to the second process control device, and The second program update manager is configured to restore the context of the pre-registered update target program after the update by using the recovery data transmitted from the first program update manager.

2. The process control system according to claim 1, wherein, When the target update program is a communication driver used to enable communication with other devices, the first program update manager is configured to block the receive port of the target update program so that no new requests will be received from the other devices.

3. The process control system according to claim 1, wherein, The pre-registered update target program is a system call or public library whose specification is clearly defined and published.

4. A process control device, comprising: The program execution unit is configured to run a non-updating target program that is not the update target and an updating target program that can be the update target; The first program update manager is configured to pause the non-updating target program based on a pause request from an external source, and to transmit the context of the non-updating target program. as well as The second program update manager is configured to restore the context of the non-updating target program using the context transmitted from the first program update manager, initialize the context of the updated target program after the update, and cause the program execution unit to restart the non-updating target program and the updated target program after the update based on a restart request from the external source, wherein... When it is determined that among the update target programs called by the non-updating target program, there is an update target program that is currently being processed, the first program update manager is configured as follows: Configure settings to prevent requests from pre-registered update target programs in the update target program from being sent to other update target programs; Wait for the processing of the target program to stop; After the processing of the update target program stops, the recovery data required to restart the processing is extracted from the context of the pre-registered update target program; as well as The extracted recovery data is transferred to the second program update manager, and The second program update manager is configured to restore the context of the pre-registered update target program after the update by using the recovery data transmitted from the first program update manager.

5. A program update method in a process control device, wherein a non-update target program that is not an update target and an update target program that can be the update target are run in the process control device, the program update method comprising: The first step is to pause the non-updating target program based on a pause request from an external source, and to transmit the context of the non-updating target program. as well as The second step involves restoring the context of the non-updating target program (which is not the update target) using the context transmitted in the first step, initializing the context of the updated target program after the update, and restarting both the non-updating target program and the updated target program based on the restart request from the outside. When it is determined that among the update target programs called by the non-updating target program, there is an update target program that is currently being processed, the first step includes: Configure settings to prevent requests from pre-registered update target programs in the update target program from being sent to other update target programs; Wait for the processing of the target program to stop; After the processing of the update target program stops, the recovery data required to restart processing is extracted from the context of the pre-registered update target program; and Transmit the extracted recovered data, and The second step includes restoring the context of the pre-registered update target program after the update by using the transmitted recovery data.

6. The program update method according to claim 5, wherein, The first step and the second step are operated in the same process control device.

7. The program update method according to claim 5, wherein, The first step and the second step are operated in different process control devices.

Images