Management system for control program of industrial controller

Abstract

A management system is provided with a first server device and a second server device. During normal operation, the first server device is in a host state, and the second server device is in a standby state. The second server device joins a first group that receives data transmitted from the first server device. The first server device transmits a first health signal to the first group at a period. The second server device switches from the standby state to the host state based on the first health signal transmitted from the first server device to the first group.

Description

Technical Field

[0001] The present embodiment relates to a management system for a control program of an industrial controller. Background Art

[0002] The control system of an industrial plant includes a management system that manages the control program of an industrial controller. The management system is composed of a server device and multiple client devices. In a large-scale industrial plant, the number of client devices may even be dozens to hundreds.

[0003] Prior art literature

[0004] Patent Literature

[0005] Patent Document 1: Japanese Patent Application Publication No. 2020-135157 Summary of the invention

[0006] Problems to be solved by the invention

[0007] In the above-mentioned management system, there is a demand for making the server devices redundant. However, in general redundant technology, for example, if two server devices are provided, another server device is required to control the two server devices, and a total of three server devices are required.

[0008] The present embodiment is designed to solve the above-mentioned problems, and an object of the present embodiment is to provide a management system for a control program of an industrial controller that can realize redundancy using two server devices.

[0009] Means for solving problems

[0010] In order to solve the above-mentioned problems, the management system of the control program of the industrial controller of the present embodiment includes: a first server device, including a first processing unit and a first database for registering control programs; and a second server device, including a second processing unit and a second database for registering programs. In normal operation, the first processing unit of the first server device is in the host state, the second processing unit of the second server device is in the standby state, and the second server device joins the first group that receives data sent from the first server device. The first processing unit of the first server device sends a first health signal to the first group at a certain period, and the second processing unit of the second server device switches from the standby state to the host state based on the first health signal sent from the first server device to the first group. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a diagram showing the configuration of a control system for an industrial plant according to the first embodiment.

[0012] Figure 2 This is a diagram showing the configuration of a first server device.

[0013] Figure 3 It is a diagram showing the configuration of the second server device.

[0014] Figure 4 This is a diagram showing the configuration of a client device.

[0015] Figure 5 This is a diagram for explaining the operation when the management system is normal.

[0016] Fig. 6A This is a diagram for explaining the operation when an abnormality occurs in the first server device.

[0017] Figure 6B This is a diagram for explaining the operation when an abnormality occurs in the first server device.

[0018] Figure 6C This is a diagram for explaining the operation when an abnormality occurs in the first server device.

[0019] Fig.6D This is a diagram for explaining the operation when an abnormality occurs in the first server device.

[0020] Fig. 7A This is a diagram for explaining the operation of the first server device when a communication failure occurs.

[0021] Figure 7B This is a diagram for explaining the operation of the first server device when a communication failure occurs.

[0022] Figure 7C This is a diagram for explaining the operation of the first server device when a communication failure occurs.

[0023] Fig.7D This is a diagram for explaining the operation of the first server device when a communication failure occurs.

[0024] Fig. 8A This is a diagram for explaining the operation of the second server device when a communication failure occurs.

[0025] Figure 8B This is a diagram for explaining the operation of the second server device when a communication failure occurs.

[0026] Fig. 9A This is a diagram for explaining the operation when both server devices are in the master state.

[0027] Fig. 9B This is a diagram for explaining the operation when both server devices are in the master state.

[0028] Fig. 9C This is a diagram for explaining the operation when both server devices are in the master state.

[0029] Fig.9D This is a diagram for explaining the operation when both server devices are in the master state. DETAILED DESCRIPTION

[0030] Hereinafter, the present embodiment will be described with reference to the accompanying drawings. In addition, in the following description, the control system of the present embodiment will be described based on an example of using the control system of the present embodiment for controlling an industrial plant. However, the applicable scope of the control system of the present embodiment is not limited to the control of an industrial plant. In addition, the same reference numerals are given to the same or corresponding elements in the accompanying drawings, and detailed descriptions are appropriately omitted.

[0031] (Implementation Method 1)

[0032] Figure 1 1 is a diagram showing the structure of a control system 1 of an industrial plant according to Embodiment 1. The control system 1 includes a management system 100 for managing a control program of an industrial controller. The management system 100 includes a first server device 10, a second server device 20, and one or more client devices 30. The management system 100 has a redundant structure. In normal operation, the first server device 10 is in a master state, that is, an operating state, and the second server device 20 is in a standby state, that is, a standby state. The first server device 10, the second server device 20, and the client device 30 are connected to a control network 61.

[0033] One or more industrial controllers 40 are connected to the control network 61. The industrial controller 40 is connected to the field network 62. One or more field devices 50 are connected to the field network 62. In addition, the specific implementation method of the control network 61 and the field network 62 is not particularly limited. As an example, the control network 61 and the field network 62 are Ethernet (registered trademark). In addition, the control network 61 can also be duplicated.

[0034] Figure 2 1 is a diagram showing the configuration of the first server device 10. The first server device 10 includes a first processing unit 11, a first storage unit 12, and a first database 13. The first processing unit 11 controls the operation of the first server device 10. The first storage unit 12 includes an area for a first health counter 12a. The first database 13 stores control programs of the industrial controller 40.

[0035] The first server device 10 manages the first group that the second server device 20 and one or more client devices 30 can join. The first server device 10 can send the same data to the second server device 20 and one or more client devices 30 that have joined the first group by sending data to the first group. Such a structure can be realized by multicast communication of UDP (User Datagram Protocol), for example.

[0036] The first health counter 12a counts up or down at a predetermined period, for example, 1 second period, while the first server device 10 functions normally. Such a configuration can be realized by, for example, generating an interrupt at a predetermined period to increment or decrement the value of the counter variable.

[0037] The specific implementation method of the first server device 10 is not particularly limited. As an example, the first server device 10 is a personal computer. In this case, the first processing unit 11 is a CPU (Central Processing Unit), and the first storage unit 12 is a RAM (Random Access Memory) and a ROM (Read Only Memory). In addition, the first database 13 is implemented by an application program executed by the CPU and a table constructed in an auxiliary storage device such as a HDD (Hard Disk Drive).

[0038] Figure 3 2 is a diagram showing the configuration of the second server device 20. The second server device 20 includes a second processing unit 21, a second storage unit 22, and a second database 23. The second processing unit 21 controls the operation of the second server device 20. An area for a second health counter 22a is provided in the second storage unit 22. The control program of the industrial controller 40 is registered in the second database 23.

[0039] The second server device 20 can generate a second group that one or more client devices 30 can join. The second server device 20 can send the same data to the one or more client devices 30 that have joined the second group by sending data to the second group. Such a structure can be realized by multicast communication of UDP, for example.

[0040] The specific implementation method of the second server device 20 is not particularly limited. As an example, the second server device 20 is a personal computer. In this case, the second processing unit 21 is a CPU, and the second storage unit 22 is a RAM and a RAM. In addition, the second database 23 is implemented by an application program executed by the CPU and a table constructed in an auxiliary storage device such as a HDD.

[0041] Figure 4 3 is a diagram showing the configuration of the client device 30. The client device 30 includes a third processing unit 31, a third storage unit 32, a display unit 33, and an input unit 34. The client device 30 can access the database of the server device that manages the group to which the client device 30 has joined. For example, when the client device 30 has joined the first group managed by the first server device 10, the client device 30 can access the first database 13 of the first server device 10. In addition, when the client device 30 has joined the second group managed by the second server device 20, the client device 30 can access the second database 23 of the second server device 20.

[0042] The user can use the functions provided by the first server device 10 or the second server device 20 via the client device 30. Specifically, the user can create, edit, add, delete, etc. the control program executed by the industrial controller 40 by operating the client device 30. In addition, the user can register the created control program in the first database 13 or the second database 23 by operating the client device 30. In addition, the user can send the control program registered in the first database 13 or the second database 23 to the industrial controller 40 and execute it by operating the client device 30.

[0043] The specific implementation method of the client device 30 is not particularly limited. As an example, the client device 30 is a personal computer. In this case, the third processing unit 31 is a CPU, and the third storage unit 32 is a RAM and a ROM. In addition, the display unit 33 is, for example, a liquid crystal display, and the input unit 34 is, for example, a keyboard and a mouse.

[0044] return Figure 1 The industrial controller 40 is a DCS (Distributed Control System) or a PLC (Programmable Logic Controller), etc. The industrial controller 40 collects the status of the industrial plant based on the signal received from the sensor (not shown) installed on the control object via the field device 50 and the field network 62.

[0045] The industrial controller 40 executes various calculations based on the collected plant statuses, and operates an actuator (not shown) and the like installed in a control target via the field network 62 and the field device 50 based on the calculation results, thereby controlling the industrial plant.

[0046] The field device 50 is a device for inputting and outputting signals with various devices installed on the control object. The field device 50 includes an AI (Analog Input) device or a DI (Digital Input) device, etc., to which a signal from a sensor installed on the control object is input. In addition, the field device 50 includes an AO (Analog Output) device or a DO (Digital Output) device, etc., which outputs a signal to an actuator installed on the control object.

[0047] Next, the operation of the management system 100 of the first embodiment is described. In the following description, it is assumed that there are two client devices 30a and 30b. When it is not necessary to distinguish between the two client devices 30a and 30b, both are collectively referred to as client devices 30. In addition, the control network 61 is duplicated by the control networks 61a and 61b.

[0048] (Normal operation)

[0049] Figure 5 1 is a diagram for explaining the operation of the management system 100 when it is normal. When the management system 100 is operating normally, the first server device 10 is in the master state and the second server device 20 is in the standby state. The second server device 20 joins the first group managed by the first server device 10 in the master state and can receive data sent from the first server device 10 to the first group.

[0050] The first database 13 of the first server device 10 and the second database 23 of the second server device 20 are equalized at a predetermined period, for example, at a period of 30 seconds. The method of equalization is not particularly limited, and as an example, the first server device 10 creates first historical information when the first database 13 is updated, and the second server device 20 performs equalization from the first database 13 to the second database 23 based on the first historical information.

[0051] The two client devices 30a and 30b join the first group managed by the first server device 10 in the master state and can receive data sent to the first group from the first server device 10. The client devices 30a and 30b can access the first database 13 of the first server device 10.

[0052] The first server device 10 sends data including the count value (first health signal) of its own first health counter 12a to the first group at a certain period, for example, at a period of 3 seconds. In addition, the data includes the machine name, IP address, and port number of the second server device 20 in standby mode.

[0053] The second server device 20 receives data transmitted from the first server device 10 to the first group at a certain period, and determines whether the first server device 10 is operating normally based on the value of the first health signal included in the data. Specifically, when the value of the first health signal received from the first server device 10 changes within a specified period, for example, 10 seconds, the second server device 20 determines that the first server device 10 is operating normally.

[0054] The client devices 30a and 30b receive the first set of data received from the first server device 10 at a certain period, and determine whether the first server device 10 is operating normally based on the value of the first health signal included in the data. Specifically, when the value of the first health signal received from the first server device 10 changes within a specified period, for example, 10 seconds, the client devices 30a and 30b determine that the first server device 10 is operating normally.

[0055] (When an abnormality occurs in the first server device)

[0056] Figure 6A to Figure 6D This is a diagram for explaining the operation when an abnormality occurs in the first server device 10. Specifically, the abnormality of the first server device 10 refers to the shutdown of the first server device 10, the cessation of the function of the application executed on the first server device 10, the abnormality of the first database 13, the cessation of the function of the operating system executed on the first server device 10, etc.

[0057] exist Fig. 6A In the example, if an abnormality occurs in the first server device 10, the value of the first health signal included in the data sent from the first server device 10 to the first group at a certain period does not change. The second server device 20 that detects this determines that the first server device 10 is not operating normally and switches from the standby state to the master state. The second server device 20 that switches to the master state leaves the first group and forms a second group.

[0058] exist Figure 6B In the embodiment, if the client devices 30a and 30b detect that the value of the first health signal included in the data sent from the first server device 10 to the first group at a certain period no longer changes, it is determined that the first server device 10 is not operating normally, and the client devices 30a and 30b leave the first group managed by the first server device 10 and join the second group generated by the second server device 20. As a result, the client devices 30a and 30b can access the second database 23 of the second server device 20.

[0059] exist Figure 6CThe second server device 20 sends data including the count value (second health signal) of its own second health counter 22a to the second group at a certain period, for example, at a period of 3 seconds. During this period, the client devices 30a and 30b can continue to access the second database 23 of the second server device 20.

[0060] exist Fig.6D In the case where the first server device 10 is restored, the first server device 10 becomes a standby state and joins the second group. At this time, the second database 23 is converted to the first database 13. The client devices 30a and 30b can continue to access the second database 23 of the second server device 20.

[0061] (When the communication with the first server fails)

[0062] Figure 7A to Figure 7D 1 is a diagram for explaining the operation when a communication failure occurs in the first server device 10. Specifically, the communication failure in the first server device 10 refers to a communication failure between the first server device 10 and the duplicated control networks 61a and 61b.

[0063] exist Fig. 7A In the example, if a communication failure occurs between the first server device 10 and the control networks 61a and 61b, data including the first health signal sent from the first server device 10 to the first group at a certain period no longer reaches the second server device 20. The second server device 20 that detects this determines that a communication failure has occurred in the first server device 10 and switches from the standby state to the master state. The second server device 20 that switches to the master state leaves the first group and forms a second group.

[0064] exist Figure 7B In the process, when data including a first health signal sent from the first server device 10 to the first group at a certain period no longer arrives, the client devices 30a and 30b determine that a communication failure has occurred in the first server device 10, and leave the first group managed by the first server device 10 and join the second group generated by the second server device 20.

[0065] exist Figure 7C In the embodiment, the second server device 20 sends data including the count value (second health signal) of its own second health counter 22a to the second group at a certain period, for example, at a period of 3 seconds. When the client devices 30a and 30b confirm that they have received the data including the second health signal sent from the second server device 20 to the second group, they can access the second database 23 of the second server device 20.

[0066] exist Fig.7DIn the example, if the communication failure between the first server device 10 and the control networks 61a and 61b is restored, the first server device 10 becomes a standby state and joins the second group. At this time, the second database 23 is converted to the first database 13. The client devices 30a and 30b can continue to access the second database 23 of the second server device 20.

[0067] (When the communication with the second server fails)

[0068] Figure 8A to Figure 8B 1 is a diagram for explaining the operation when a communication failure occurs in the second server device 20. Specifically, the communication failure in the second server device 20 refers to a communication failure between the second server device 20 and the duplicated control networks 61a and 61b.

[0069] exist Fig. 8A In the example, if a communication failure occurs between the second server device 20 and the control networks 61a and 61b, data including the first health signal sent from the first server device 10 to the first group at a certain period no longer reaches the second server device 20. The second server device 20 that detects this will mistakenly determine that a communication failure has occurred in the first server device 10 and switch from the standby state to the master state. The second server device 20 that has switched to the master state leaves the first group and forms a second group.

[0070] However, since the first server device 10 does not actually have a communication failure, the client devices 30a and 30b can receive data including the first health signal periodically transmitted from the first server device 10 to the first group. Therefore, the client devices 30a and 30b can continue to access the first database 13 of the first server device 10.

[0071] exist Figure 8B In the example, if the communication failure between the second server device 20 and the control networks 61a and 61b is restored, the second server device 20 becomes a standby state again and joins the first group. At this time, the first database 13 is converted to the second database 23. The client devices 30a and 30b can continue to access the first database 13 of the first server device 10.

[0072] (When both server devices are in master state)

[0073] FIG. 9A to FIG. 9B This is a diagram for explaining the operation when both the first server device 10 and the second server device 20 are in the master state. Such a state may be caused by a communication failure between the first server device 10 and the control network 61b and a communication failure between the second server device 20 and the control network 61a.

[0074] exist Fig. 9A In the process, data including the first health signal sent from the first server device 10 to the first group at a certain period no longer reaches the second server device 20. The second server device 20 that detects this switches from the standby state to the master state. The second server device 20 that switches to the master state leaves the first group and forms a second group.

[0075] exist Fig. 9B In the embodiment, when data including the first health signal transmitted from the first server device 10 to the first group at a certain period no longer arrives, the client device 30b leaves the first group managed by the first server device 10 and joins the second group generated by the second server device 20. Thus, the client device 30b accesses the second database 23 of the second server device 20.

[0076] On the other hand, since the client device 30a can receive data including the first health signal transmitted from the first server device 10 to the first group at a certain period, it stays in the first group managed by the first server device 10. Therefore, the client device 30a continues to access the first database 13 of the first server device 10. By continuing this state, the content of the first database 13 deviates from the content of the second database 23.

[0077] exist Fig. 9C In the embodiment, if the communication failures of the control networks 61a and 61b are all restored, the first server device 10 maintains the master state and continues to send data including the first health signal. On the other hand, when the second server device 20 receives data including the first health signal sent from the first server device 10, it switches from the master state to the standby state, rejoins the first group, and stops sending data including the second health signal.

[0078] exist Fig.9D In the example, the client device 30a remains in the first group and continues to access the first database 13 of the first server device 10. On the other hand, when the data including the second health signal sent from the second server device 20 no longer arrives, the client device 30b leaves the second group and rejoins the first group. As a result, the client device 30b can access the first database 13 of the first server device 10 again. At this time, the first database 13 and the second database 23 are equalized.

[0079] As described above, in the management system 100 of the first embodiment, during normal operation, the first server 10 is in the master state and the second server 20 is in the standby state. In addition, the second server 20 participates in the first group receiving data transmitted from the first server 10.

[0080] The first server device 10 transmits a first health signal to the first group at a certain period, and the second server device 20 switches from the standby state to the master state based on the first health signal transmitted from the first server device 10 to the first group.

[0081] Through the above-mentioned features, in the management system 100 of the first embodiment, redundancy can be achieved by using two server devices. As a result, two server devices are now sufficient, which previously required three, and thus the cost is greatly reduced. In addition, since the second server device 20 is automatically switched from the standby state to the main state, the user can save the trouble of switching.

[0082] In addition, during normal operation, the client device 30 joins the first group managed by the first server device 10. Based on the first health signal sent from the first server device 10 to the first group, the client device 30 leaves the first group and joins the second group generated by the second server device 20. Thus, when the second server device 20 switches to the master state, the client device 30 automatically connects to the second server device 20. Therefore, the user can save the trouble of switching.

[0083] Furthermore, the client device 30 accesses the first database 13 of the first server device 10 when joining the first group, and accesses the second database 23 of the second server device 20 when joining the second group. Thus, the client device 30 can always access the database of the server device in the master state.

[0084] The first server device 10 creates a first update history when the first database 13 is updated, and the second server device 20 performs equalization from the first database 13 to the second database 23 based on the first update history. The second server device creates a second update history when the second database is updated, and the first server device 10 performs equalization from the second database 23 to the first database 13 based on the second update history. In this way, the contents of the first database 13 and the second database 23 can always be kept the same.

[0085] Several embodiments have been described, but these embodiments are presented as examples and are not intended to limit the scope of the embodiments. These embodiments can be implemented in various other ways, and various omissions, substitutions, changes, and combinations can be made without departing from the scope of the embodiment. These embodiments and their variations are included in the scope and purpose of the embodiment, and are also included in the claims and their equivalents.

[0086] In addition, this embodiment may also adopt the following structure.

[0087] [Item 1] (First server device, second server device)

[0088] A management system is a management system for a control program of an industrial controller, wherein the management system comprises:

[0089] A first server device includes a first processing unit and a first database for registering the control program; and

[0090] A second server device including a second processing unit and a second database for registering the control program;

[0091] In normal operation, the first processing unit of the first server device is in a master state, the second processing unit of the second server device is in a standby state, and the second server device joins a first group that receives data sent from the first server device.

[0092] The first processing unit of the first server device sends a first health signal to the first group at a certain period,

[0093] The second processing unit of the second server device switches from the standby state to the master state based on the first health signal transmitted from the first server device to the first group.

[0094] [Item 2] (First server device, second server device)

[0095] The management system according to item 1, wherein the second processing unit of the second server device, when switched to the master state, separates from the first group and generates a second group that receives data transmitted from the second server device.

[0096] [Item 3] (First server device, second server device)

[0097] The management system according to item 2, wherein the second processing unit of the second server device sends the second health signal to the second group at a certain period.

[0098] [Item 4] (First server device, second server device)

[0099] The management system according to any one of items 1 to 3, wherein:

[0100] The first health signal is a signal that increases or decreases in a specified period.

[0101] The second processing unit of the second server device switches from the standby state to the master state when the value of the first health signal transmitted from the first server device to the first group does not change within a predetermined period.

[0102] [Item 5] (First server device, second server device)

[0103] The management system according to any one of items 1 to 4, wherein the second processing unit of the second server device switches from the standby state to the master state when the second processing unit of the second server device fails to receive the first health signal transmitted from the first server device to the first group.

[0104] [Item 6] (Client device)

[0105] The management system according to item 2, wherein:

[0106] The management system further comprises one or more client devices including a third processing unit.

[0107] In the normal operation, the client device joins the first group,

[0108] The third processing unit of the client device leaves the first group and joins the second group based on the first health signal transmitted from the first server device to the first group.

[0109] [Item 7] (Client device)

[0110] The management system according to item 6, wherein the third processing unit of the client device accesses the first database of the first server device when joining the first group, and accesses the second database of the second server device when joining the second group.

[0111] [Project 8] (Database equivalence)

[0112] The management system according to any one of items 1 to 7, wherein:

[0113] The first processing unit of the first server device creates a first update history when the first database is updated, and the second processing unit of the second server device performs equivalence conversion from the first database to the second database based on the first update history.

[0114] The second processing unit of the second server device creates a second update history when the second database is updated, and the first processing unit of the first server device performs equivalence from the second database to the first database based on the second update history.

[0115] Description of Reference Numerals

[0116] 1. Control system

[0117] 10First server device

[0118] 11First processing unit

[0119] 12 first storage unit

[0120] 12a First Health Counter

[0121] 13First Database

[0122] 20 Second server device

[0123] 21 Second processing unit

[0124] 22 Second storage unit

[0125] 22a Second health counter

[0126] 23 Second Database

[0127] 30 Client devices

[0128] 30a Client Device

[0129] 30b Client Device

[0130] 31Third Processing Unit

[0131] 32 third storage unit

[0132] 33 Display unit

[0133] 34 Input section

[0134] 40 Industrial Controllers

[0135] 50 Field equipment

[0136] 61 Control Network

[0137] 61a Control Network

[0138] 61b control network

[0139] 62 Live Network

[0140] 100 Management System

Claims

1. A management system, which is a management system for control programs of industrial controllers, characterized in that: have: A first server device includes a first processing unit and a first database for registering the control program; and A second server device including a second processing unit and a second database for registering the control program; In normal operation, the first processing unit of the first server device is in a master state, the second processing unit of the second server device is in a standby state, and the second server device joins a first group that receives data sent from the first server device. The first processing unit of the first server device sends a first health signal to the first group at a certain period, The second processing unit of the second server device switches from the standby state to the master state based on the first health signal transmitted from the first server device to the first group.

2. The management system according to claim 1, characterized in that: When the second processing unit of the second server device is switched to the master state, the second processing unit separates from the first group and generates a second group that receives data transmitted from the second server device.

3. The management system according to claim 2, characterized in that: The second processing unit of the second server device transmits a second health signal to the second group at a predetermined period.

4. The management system according to claim 1, characterized in that: The first health signal is a signal that increases or decreases in a specified period. The second processing unit of the second server device switches from the standby state to the master state when the value of the first health signal transmitted from the first server device to the first group does not change within a predetermined period.

5. The management system according to claim 1, characterized in that: The second processing unit of the second server device switches from the standby state to the master state when the second processing unit fails to receive the first health signal transmitted from the first server device to the first group.

6. The management system according to claim 2, characterized in that: The management system further comprises one or more client devices including a third processing unit. In the normal operation, the client device joins the first group, The third processing unit of the client device leaves the first group and joins the second group based on the first health signal transmitted from the first server device to the first group.

7. The management system according to claim 6, characterized in that: The third processing unit of the client device accesses the first database of the first server device when the client device joins the first group, and accesses the second database of the second server device when the client device joins the second group.

8. The management system according to claim 1, characterized in that: The first processing unit of the first server device creates a first update history when the first database is updated, and the second processing unit of the second server device performs equivalence conversion from the first database to the second database based on the first update history. The second processing unit of the second server device creates a second update history when the second database is updated, and the first processing unit of the first server device performs equivalence from the second database to the first database based on the second update history.

Images