Controller system

Abstract

To appropriately use a redundantly configured controller.SOLUTION: A controller system includes first and second controllers 1, 2 each having a function of controlling the state of a control object device 110 and a state monitoring section 200 for monitoring whether an own apparatus runs into a difficulty, and one of the first and second controllers 1, 2 functions as an execution system device for controlling the control object device 110, and the other functions as a standby system device for taking over control to the control object device 110 on the basis of data supplied from the execution system device when a difficulty occurs in the execution system device. The first and second controllers 1, 2 have mutual communication sections 53, 54 communicating with each other and a pair control object communication section 46 communicating with the control object device 110 each.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a controller system. [Background technology]

[0002] As background art in this technical field, the following Patent Documents 1 and 2 describe methods for detecting an abnormality in a redundant configuration. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2014-164472 A [Patent Document 2] JP 2013-232142 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above-mentioned technology, there is a demand for more appropriate operation of the redundantly configured controller. The present invention has been made in view of the above-mentioned circumstances, and has an object to provide a controller system capable of appropriately operating controllers configured in a redundant manner. [Means for solving the problem]

[0005] In order to solve the above problems, the controller system of the present invention comprises first and second controllers, each having a function of controlling the status of a controlled device and a status monitoring unit that monitors whether a failure has occurred in the device itself, and is characterized in that one of the first and second controllers functions as an execution device that controls the controlled device, and the other functions as a standby device that takes over control of the controlled device based on data supplied from the execution device when a failure occurs in the execution device. Effect of the Invention

[0006] According to the present invention, a controller configured for redundancy can be appropriately operated. [Brief description of the drawings]

[0007] [Figure 1] FIG. 2 is a block diagram (1 / 2) of a controller system according to the first embodiment. [Diagram 2] FIG. 2 is a block diagram (2 / 2) of the controller system according to the first embodiment. [Diagram 3] FIG. 2 is a rear view of the controller according to the first embodiment. [Figure 4] FIG. 2 is a sequence diagram of the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] [Prerequisites for the embodiment] One possible method of detecting abnormalities in a redundant configuration is to exchange survival information between the active system and the standby system via a network, and detect an abnormality in the other system when an abnormality occurs in the data transmission or reception.

[0009] For example, by applying the technology of the above-mentioned Patent Document 1, an interrupt signal can be periodically sent to the CPU of the device itself by a dedicated I / O card to monitor the survival of the active system. In other words, if the CPU processing of the active system is not normally executed in response to the interrupt signal, a fault notification signal to notify the fault can be sent to the standby system. Furthermore, when the standby system device receives the fault notification signal, it can switch systems and continue operation as a whole system.

[0010] Furthermore, by applying the technology of Patent Document 2, it is possible to exchange alive monitoring information between the active system and the standby system at a specified cycle, and if an abnormality occurs, it is possible to execute a process to determine which element of the alive monitoring process is abnormal. This makes it possible to confirm the power status of the other system and send information to shut down the power of the abnormal system, thereby ensuring reliable system switching.

[0011] However, the technology that applies Patent Document 1 requires the preparation of a dedicated fault notification signal in order to grasp information from other systems. Also, the periodically received interrupt signal needs to be processed in the CPU of the own system, which means that a certain amount of CPU resources is always used. In the field of controllers, which have a short control cycle, if an interrupt occurs periodically in the CPU, it may affect normal control processing.

[0012] Furthermore, in the technology to which Patent Document 2 is applied, in order to accurately grasp the states of both systems, many dedicated control lines and processes are required, such as a mechanism for checking the cable connection status and setting status of both systems and a mechanism for resetting the other system. This makes it possible to perform configuration control as intended, but the judgments and processes required before switching systems are numerous and complex. Therefore, in the field of control devices that require a short control cycle, it takes time to switch systems, and it may not be possible to meet the system switching time required for the system.

[0013] Therefore, in the embodiment described later, a technique is provided that performs system switching by minimizing the signals and processing required for system switching and also performs configuration control reliably as intended.

[0014] [First embodiment] Configuration of the First Embodiment 1 and 2 are block diagrams of a controller system 100 according to a first embodiment. 1 and 2, a controller system 100 includes a controller 1 (first controller) shown in Fig. 1, a controller 2 (second controller) shown in Fig. 2, a control target device 110, and cables 71 and 72. The cables 71 and 72 connect the controllers 1 and 2.

[0015] The hardware configurations of the controllers 1 and 2 are the same. However, one of the controllers 1 and 2 is an "execution device" that controls the control target device 110, and the other is a "standby device" that controls the control target device 110 when a failure occurs in the execution device. The functional blocks and data flow shown in Figures 1 and 2 mainly show an example in which the controller 1 is the execution device and the controller 2 is the standby device, but the functions of the controllers 1 and 2 can be reversed.

[0016] In FIG. 1, the controller 1 includes a CPU 42-1, a memory 60-1, a status monitoring unit 200-1, an I / O control unit 46-1 (a control target communication unit), a DC-DC converter 48-1, and network I / F units 53-1 and 54-1 (intercommunication units). In addition, the controller 2 (see FIG. 2) includes the same components as the controller 1, although some components are not shown. In the following description, when it is not specifically stated that each element belongs to either the controller 1 or the controller 2, it is expressed as, for example, a "status monitoring unit 200". When it is specifically stated that each element belongs to the controller 1, "-1" is added after the reference numeral, for example, "status monitoring unit 200-1". Similarly, when it is specifically stated that each element belongs to the controller 2, "-2" is added after the reference numeral, for example, "status monitoring unit 200-2".

[0017] The memory 60 stores an OS (Operating System), control programs, etc. An equalization area 62 (equalization data storage unit) is provided in a portion of the memory 60, and various states of the control target device 110 are stored here as equalization data EQD. The CPU 42 executes the OS, control programs, etc. stored in the memory 60. The I / O control unit 46 (unit for communicating with the control target) inputs and outputs various control signals to and from the control target device 110. The DC-DC converter 48-1 receives a DC voltage V1 from an external power supply device (not shown), converts it to a DC voltage V2 which is a lower voltage, and supplies the DC voltage V2 to each unit of the controller 1.

[0018] Network I / F units 53, 54 (intercommunication units) are connected to receptacles 51, 52. Plugs 81, 82 are attached to cables 71, 72, and the plugs 81, 82 are fitted into receptacles 51, 52. Cables 71, 72 form lines CH1 (first line) and CH2 (second line), which are independent of each other (i.e., have no physical connection to each other), and controllers 1, 2 communicate via lines CH1, CH2, respectively. Lines CH1, CH2 are, for example, LANs (Local Area Networks), but other protocols may also be applied.

[0019] The equalization data EQD in the executing device (for example, controller 1) is transmitted to the standby device (controller 2) as equalization data EQD1 and EQD2 having the same contents via lines CH1 and CH2, respectively. That is, in the executing device, the relationship of "EQD=EQD1=EQD2" is established. Then, in the standby device, one of the received equalization data EQD1 and EQD2 is selected as equalization data EQD, and the contents are copied to the equalization area 62-2 in the standby device. In this way, when a failure occurs in the executing device, the standby device can take over the control that was being performed by the executing device based on the equalization data EQD previously supplied from the executing device, and immediately continue control of the control target device 110.

[0020] The state monitoring unit 200 is preferably realized by an integrated circuit such as an FPGA (Field Programmable Gate Array) in order to perform quick judgment with a relatively small amount of processing. In Fig. 1 and Fig. 2, the inside of the state monitoring unit 200 is shown as a block of functions realized by the FPGA or the like. That is, as shown in Fig. 1, the state monitoring unit 200 includes a CPU monitoring unit 212, a power supply monitoring unit 214, an FPGA monitoring unit 216, a network monitoring unit 218, a memory monitoring unit 220, a DMA function unit 230, an I / O control monitoring unit 242, an equalization determination unit 252, a two-system simultaneous abnormality detection unit 254 (abnormality detection unit), a master / slave state management unit 256, a network OE control unit 262, and an I / O·OE control unit 264.

[0021] The CPU monitoring unit 212 monitors whether or not there is an abnormality in the CPU 42. The power supply monitoring unit 214 monitors whether or not there is an abnormality in the DC-DC converter 48. The FPGA monitoring unit 216 monitors whether or not there is an abnormality in the state monitoring unit 200 itself, i.e., the health of the state monitoring unit 200. The memory monitoring unit 220 monitors whether or not there is an abnormality in the memory 60. The network monitoring unit 218 monitors whether or not there is an abnormality in the network I / F units 53, 54. The I / O control monitoring unit 242 monitors whether or not there is an abnormality in the I / O control unit 46.

[0022] The DMA function unit 230 in the execution system device (for example, the controller 1) reads out the equalization data EQD stored in the equalization area 62 at a predetermined equalization period, and supplies it to the network I / F units 53 and 54. As a result, the network I / F units 53 and 54 supply the supplied equalization data EQD to the standby system device (for example, the controller 2) as equalization data EQD1 and EQD2, respectively. The period setting unit 232 in the DMA function unit 230 sets the equalization period for transmitting the equalization data EQD. The equalization period can be arbitrarily set by the user depending on the function of the controller system 100.

[0023] Although the details will be described later, if no particular failure occurs in the transmission of the equalization data EQD1, EQD2, the equalization data EQD is reflected in the equalization area 62 in the standby device (for example, controller 2). As a result, the contents of the equalization areas 62 in the controllers 1, 2 are balanced at a predetermined equalization period.

[0024] The equalization determination unit 252, the two-system simultaneous abnormality detection unit 254, and the master / slave status management unit 256 function mainly when the controller 1 is the standby system device. The contents of these functions will be described later with reference to FIG.

[0025] The network OE control unit 262 performs OE (output enable) control on the network I / F units 53 and 54, i.e., controls whether or not to permit signal output to the cables 71 and 72. The I / O·OE control unit 264 performs OE control on the I / O control unit 46, i.e., controls whether or not to permit signal output to the control target device 110.

[0026] If the above-mentioned CPU monitoring unit 212, power supply monitoring unit 214, FPGA monitoring unit 216, network monitoring unit 218, memory monitoring unit 220, or I / O control monitoring unit 242 detects any abnormality, the network OE control unit 262 stops data transmission to the network I / F units 53, 54, and the I / O·OE control unit 264 stops data transmission to the I / O control unit 46.

[0027] In this way, the network OE control unit 262 and the I / O·OE control unit 264 stop data transmission by performing OE control as necessary on the network I / F units 53, 54 and the I / O control unit 46. However, instead of performing OE control, data transmission may be stopped by cutting off the power supplied to the network I / F units 53, 54 or the I / O control unit 46.

[0028] 2, when the controller 2 is a standby device, it receives the equalization data EQD1 and EQD2 from the lines CH1 and CH2 via the network I / F units 53-2 and 54-2, respectively. At this time, the dual-system simultaneous abnormality detection unit 254 in the controller 2 judges whether the equalization data EQD1 and EQD2 are normally received from the two lines CH1 and CH2, respectively.

[0029] When the equalization data EQD1 is normally received, the equalization determination unit 252 selects the equalization data EQD1 as the equalization data EQD regardless of the reception result of the equalization data EQD2. When the equalization data EQD is not normally received but the equalization data EQD2 is normally received, the equalization determination unit 252 selects the equalization data EQD2 as the equalization data EQD.

[0030] Then, the equalization determination unit 252 reflects, i.e. copies, the contents of the selected equalization data EQD in the equalization area 62-2 of the controller 2. If neither of the equalization data EQD1, EQD2 is received normally, the equalization determination unit 252 stops updating the equalization area 62-2. As a result, when at least one of the lines CH1, CH2 is normal, the equalization data EQD is stored in the equalization area 62-2 of the standby device at the equalization period.

[0031] Moreover, if neither of the equalization data EQD1 and EQD2 is received normally, the two-system simultaneous abnormality detection unit 254 outputs a master-slave switching instruction to the master-slave status management unit 256. The master-slave status management unit 256 manages the function of its own device (active system device / standby system device).

[0032] Then, when the master / slave status management unit 256 in the standby device (for example, controller 2) receives a master / slave switching instruction from the both-system simultaneous abnormality detection unit 254, it switches itself to the active device. As a result, the controller 2, which was the standby device, becomes the active device and takes over control of the control target device 110 based on the equalization data EQD stored in the equalization area 62. Note that when the failure is subsequently restored, the controller 1 resumes communication with the controller 2. Then, the master / slave status management unit 256 of the controller 1 sets the function of its own device to that of the standby device.

[0033] In this embodiment, when some abnormality occurs in the status monitoring unit 200 of the execution system device (for example, the controller 1), the network OE control unit 262 simultaneously stops data transmission to the network I / F units 53 and 54. Therefore, from the standpoint of the standby system device (the controller 2), it appears as if the execution system device has been powered off. As a result, the function of the standby system device is switched over to the execution system device, which takes over control of the control target device 110, allowing the controller system 100 to continue normal operation.

[0034] In other words, in this embodiment, the equalization data EQD required for normal system operation is repeated at a predetermined equalization period to monitor the alive state between the controllers 1 and 2, rather than providing a dedicated notification signal. This allows the standby device to quickly detect the occurrence of a failure in the active device.

[0035] 3 is a rear view of controller 1. The rear shape of controller 2 is the same as that of controller 1. The controller 1 is formed in a substantially rectangular parallelepiped frame shape, and a substantially Π-shaped metal fitting 600 is attached to its back plate 1b with screws 620, 620. Circular through holes 611, 612 are formed in a back plate 602 of the metal fitting 600, and cables 71, 72 are respectively inserted through these holes. Plugs 81, 82 are attached to the ends of the cables 71, 72, and these are fitted into receptacles 51, 52 provided on the back of the controller 1, respectively.

[0036] As described above, the standby device in this embodiment judges that the other device is abnormal when both of the equalization data EQD1 and EQD2 from the active device are cut off (for example, simultaneously). This means that if both of the cables 71 and 72 are removed due to human error, the standby device may erroneously judge that the active device is abnormal. However, by providing a metal fitting 600 that engages with the cables 71 and 72 as shown in FIG. 3, it is possible to prevent both of the cables 71 and 72 from being removed due to human error. Note that, in addition to the example shown in FIG. 3, measures may be taken to prevent both of the cables 71 and 72 from being removed. For example, the plugs 81 and 82 may be fixed to the receptacles 51 and 52 with screws or the like.

[0037] Operation of the First Embodiment Next, the operation of the first embodiment will be described. FIG. 4 is a sequence diagram of the first embodiment. 4, it is assumed that both lines CH1 and CH2 are normal. It is also assumed that controller 1 is the active system device and controller 2 is the standby system device. It is also assumed that equalization data EQD1 and EQD2 are supplied to the two-system simultaneous abnormality detection unit 254 via lines CH1 and CH2 at time t102.

[0038] Next, at time t104, the equalization data EQD1 and EQD2 are supplied to the equalization determination section 252. The equalization determination section 252 selects the equalization data EQD1 as the equalization data EQD, and at time t106, writes the contents of the equalization data EQD1 to the equalization area 62. This causes the contents of the equalization areas 62 in the controllers 1 and 2 to be balanced. Then, when both lines CH1 and CH2 are normal, the same processing as that from time t102 to t106 is repeated at an equalization period.

[0039] Next, assume that a fault due to disconnection occurs in the line CH1 during the period TB. As a result, at time t122, the two-system simultaneous abnormality detection unit 254 receives the equalization data EQD2 via the line CH2, but cannot receive the equalization data EQD1. Next, at time t124, the equalization determination unit 252 selects the equalization data EQD2 as the equalization data EQD, and at time t126, writes the contents of the equalization data EQD to the equalization area 62. As a result, the contents of the equalization areas 62 in the controllers 1 and 2 are balanced during the period TB as well. Then, even if the fault remains in the line CH1, if the line CH2 is normal, the same processing as that from time t122 ​​to t106 is repeated in an equalization cycle.

[0040] Next, during a period TC, it is assumed that the status monitoring unit 200 of the controller 1 detects some abnormality in the controller 1. As a result, at time t130, the network OE control unit 262 of the controller 1 simultaneously stops data transmission to the network I / F units 53 and 54 in the controller 1. The dual-system simultaneous abnormality detection unit 254 in the controller 2 recognizes that neither of the equalization data EQD1 nor EQD2 has been received at time t132, which is an equalization period that has elapsed since the timing when either of the equalization data EQD1 or EQD2 was previously received.

[0041] As a result, at time t134, the two-system simultaneous abnormality detection unit 254 outputs a master-slave switching instruction to the master-slave status management unit 256. Based on this master-slave switching instruction, the master-slave status management unit 256 switches the controller 2 to the active system device.

[0042] [Effects of the embodiment] As described above, according to the embodiment, the controller system 100 includes first and second controllers (1, 2) each having a function of controlling the state of the control target device 110 and a state monitoring unit 200 for monitoring whether a failure has occurred in the control target device, and one of the first and second controllers (1, 2) functions as an execution device that controls the control target device 110, and the other functions as a standby device that takes over control of the control target device 110 when a failure occurs in the execution device.

[0043] Therefore, if a failure occurs in the executing device, the standby device can take over control of the control target device 110 based on the data supplied from the executing device. This makes it possible to effectively use the data supplied from the executing device, and to properly operate the redundantly configured controller.

[0044] Furthermore, the first and second controllers (1, 2) each have an intercommunication unit (53, 54) for communicating with the other side, and a control target communication unit (46) for communicating with the control target device 110, and it is more preferable that the status monitoring unit 200 in the first and second controllers (1, 2) stops data output to both the intercommunication unit (53, 54) and the control target communication unit (46) in the first and second controllers (1, 2) when it detects a fault in the own device.

[0045] As a result, if a fault occurs in the first or second controller (1, 2), the status monitoring unit 200 can stop data output to both the intercommunication unit (53, 54) in the own device and the control target communication unit (46) in the own device, thereby preventing adverse effects on the outside.

[0046] Furthermore, the first and second controllers (1, 2) each have an equalization data storage unit (62) that stores the state of the controlled device 110 as equalization data EQD, and when functioning as an executing device, a function of acquiring the state of the controlled device 110 via a controlled object communication unit (46) in the own device and writing the acquired result as equalization data EQD in the equalization data storage unit (62) in the own device, and a function of transmitting the equalization data EQD stored in the equalization data storage unit (62) in the own device via a mutual communication unit (46) in the own device. It is even more preferable that the execution device further comprises a function of transmitting the equalization data EQD received via the intercommunication unit (53, 54) to the standby device at a predetermined equalization period, a function of storing the equalization data EQD received via the intercommunication unit (53, 54) in an equalization data storage unit (62) of the execution device when functioning as the standby device, and an abnormality detection unit (254) for determining that a fault has occurred in the execution device when the execution device functions as the standby device and the next equalization data EQD cannot be received even after the elapse of the equalization period from the timing when the equalization data EQD was last received.

[0047] As a result, the standby device can determine that a fault has occurred in the active device if it fails to receive the next equalization data EQD even after the equalization period has elapsed since the timing of the previous reception of the equalization data EQD. This eliminates the need for the active device to transmit a dedicated fault notification signal or the like to the standby device to check whether the active device is alive. The standby device can then detect that a fault has occurred in the active device by the simple operation of monitoring the equalization data EQD. As a result, if a fault occurs in the active device, the standby device can quickly detect that fact.

[0048] Furthermore, it is more preferable that the first and second controllers (1, 2), when functioning as standby devices, each further include a master-slave status management unit 256 that changes the function of its own device to that of the executing device when an abnormality detection unit (254) in the own device determines that a fault has occurred in the executing device.

[0049] As a result, if a failure occurs in the executing device, the standby device can make itself function as the new executing device, which allows the controller system 100 as a whole to continue processing. In other words, an abnormality in the executing device can be detected instantly, and the standby device can be changed to the executing device, allowing the controller system 100 to continue processing.

[0050] Moreover, the intercommunication units (53, 54) communicate with each other via independent first and second lines (CH1, CH2), and the first and second controllers (1, 2) each have a function of transmitting equalization data EQD from their own intercommunication units (53, 54) to the standby devices via the first and second lines (CH1, CH2) when functioning as an executing device, and it is more preferable that the abnormality detection unit (254) determines that a failure has occurred in the executing device when the next equalization data EQD cannot be received from both the first and second lines (CH1, CH2) even after an equalization period has elapsed since the timing of the previous reception of the equalization data EQD. In this way, when a simple communication failure occurs in one of the first and second lines (CH1, CH2), the previous executing device can continue to control the control target device 110 as it is.

[0051] [Variations] The present invention is not limited to the above-mentioned embodiment, and various modifications are possible. The above-mentioned embodiment is exemplified to explain the present invention in an easy-to-understand manner, and is not necessarily limited to those having all the configurations described. In addition, other configurations may be added to the configurations of the above-mentioned embodiment, and it is also possible to replace some of the configurations with other configurations. In addition, the control lines and information lines shown in the figure show those that are considered necessary for explanation, and do not necessarily show all the control lines and information lines necessary on the product. In reality, it may be considered that almost all the configurations are connected to each other.

[0052] (1) In the above embodiment, the state monitoring unit 200 is realized by an FPGA or the like. However, some of the functions of the state monitoring unit 200 may be replaced by software processing in the CPU 42. This makes it possible to reduce the scale of the state monitoring unit 200. [Explanation of symbols]

[0053] 1 Controller (First Controller) 2 Controller (Second Controller) 46 I / O control unit (communication unit for controlled objects) 53, 54 Network I / F section (intercommunication section) 62 Equalization area (equalization data storage section) 100 Controller System 110 Controlled Device 200 Status monitoring unit 254 Dual-system simultaneous abnormality detection unit (abnormality detection unit) 256 Master-slave status management unit CH1 Line (1st Line) CH2 Line (Second Line) EQD Equalize Data

Claims

1. a first controller and a second controller each having a function of controlling a state of a controlled device and a state monitoring unit for monitoring whether a failure has occurred in the controlled device; One of the first and second controllers functions as an execution system device that controls the control target device, and the other functions as a standby system device that takes over control of the control target device based on data supplied from the execution system device when a failure occurs in the execution system device. A controller system comprising:

2. The first and second controllers each include: an intercommunication unit for communicating with a counterpart; a control target communication unit that communicates with the control target device, When the state monitoring unit in the first and second controllers detects a fault in the own device, the state monitoring unit stops data output to both the intercommunication unit in the own device and the control target communication unit in the own device.

2. The controller system of claim 1.

3. The first and second controllers each include: an equalization data storage unit that stores the state of the control target device as equalization data; a function of acquiring a state of the control target device via the control target communication unit in the own device when the device functions as the execution device, and writing the acquired result as the equalization data in the equalization data storage unit in the own device; a function of transmitting the equalization data stored in the equalization data storage unit of the own device to the standby device at a predetermined equalization period via the mutual communication unit of the own device when the own device functions as the execution device; a function of storing the equalization data received via the intercommunication unit in the own device in the equalization data storage unit in the own device when the own device functions as the standby device; and an abnormality detection unit that determines that a failure has occurred in the execution device when the execution device functions as the standby device and the next equalization data cannot be received even after the equalization period has elapsed since the timing of the previous reception of the equalization data.

3. The controller system of claim 2.

4. The first and second controllers each include: The device further includes a master-slave status management unit that changes the function of the device itself to the executing device when the device functions as the standby device and the abnormality detection unit in the device itself determines that a failure has occurred in the executing device.

4. The controller system of claim 3.

5. the intercommunication unit communicates with each other via independent first and second lines, each of the first and second controllers has a function of transmitting the equalization data from the intercommunication unit in itself to the standby system device via the first and second lines when functioning as the active system device; The abnormality detection unit determines that a failure has occurred in the execution system device when the next equalization data cannot be received from both the first and second lines even after the equalization period has elapsed since the timing of the previous reception of the equalization data.

5. The controller system of claim 4.

Images