Plant instrumentation control system and program rewriting method for plant instrumentation control system

Abstract

To provide a plant instrumentation control system and a program rewriting method for the plant instrumentation control system with which an unverified update version program is never put into action.SOLUTION: When a program for controlling a controlled device is operating in each of an execution region of a control system controller 10A and an execution region of a standby system controller 10B, a program in a non-execution region of the standby system controller 10B is rewritten with an update version program. In response to an instruction input indicating that there is no problem in the update version program from an operator of an engineering tool 30, the execution region of the standby system controller 10B is switched with a non-execution region, and then control switching is performed such that the control system controller 10A is provided as a standby system controller and the standby system controller 10B is provided as a control system controller.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present application relates to a plant instrumentation control system and a method for rewriting a program for a plant instrumentation control system. [Background technology]

[0002] Conventionally, in an instrumentation control system, when updating a program in a duplicated control device, before putting the updated program into actual operation, the updated program is first installed in the standby control device, and the input data of the control system control device, which is still running the pre-update program, is used as input to the standby control device to run the updated program, and the operating results of both programs before and after the update are compared (for example, see Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2016-24798 A Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional plant instrumentation control systems and methods for rewriting programs for plant instrumentation control systems have the problem that if an updated program is written to a standby control device and the operation results of both programs before and after the update are compared and verified, and an error is found in the program, making it necessary to revert to the state before the update, the operator must once again write the pre-update program from an engineering tool to the standby control device, which is time-consuming.

[0005] In addition, if an updated program is written to the standby control device and an abnormality occurs due to external disturbances or other factors before operational verification of the updated program is completed, and switching between the control system and the standby system is performed between the control devices, there is an issue where the unverified updated program ends up in actual operation.

[0006] The present application discloses technology for solving the problems described above, and aims to provide a plant instrumentation control system and a method for rewriting a program for a plant instrumentation control system that can easily restore the program if an updated program is written to a standby control device and the operation results of both programs before and after the update are compared and verified, and it is found that there is an error in the program and it is necessary to return to the state before the update, and that can also prevent the unverified updated program from being put into actual operation if an abnormality occurs due to a disturbance or other factor when the updated program is written to the standby control device and the operation verification of the updated program is not yet completed, and a switch is made between the control system and the standby system between the control devices. [Means for solving the problem]

[0007] The plant instrumentation control system disclosed in the present application comprises: a duplicated control device in which a control device of a control system which controls a controlled device and a standby control device as a backup device for the control device of the control system are duplicated; an input / output device that inputs and outputs to the duplicated control device; an engineering tool for editing the programs of the two control devices of the duplicated control device and engineering data used by the two control devices; Each of the control devices has a first program memory area for storing a program of the control device and a second program memory area for storing the program of the control device, and when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area for not controlling the controlled device, and the execution area and the non-execution area are interchangeable. a processor that reads input data from the input / output device and executes the programs on the execution area and the non-execution area, When the program for controlling the controlled device is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, rewriting the program in the non-execution area of ​​the control device of the standby system with an updated program; When an instruction input is received from the operator of the engineering tool indicating that there is no problem with the updated program, the execution area and the non-execution area of ​​the standby control device are swapped, and then a standby switch is performed in which the control device of the control system becomes the standby control device and the standby control device becomes the control device of the control system. In addition, the plant instrumentation control system disclosed in the present application is a duplicated control device in which a control device of a control system which controls a controlled device and a standby control device as a backup device for the control device of the control system are duplicated; an input / output device that inputs and outputs to the duplicated control device; an engineering tool for editing the programs of the two control devices of the duplicated control device and engineering data used by the control devices; Each of the control devices has a first program memory area for storing a program of the control device and a second program memory area for storing the program of the control device, and when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area for not controlling the controlled device, and the execution area and the non-execution area are interchangeable. an equivalence processing unit that equivalences the contents of the execution region with the contents of the non-execution region; a processor that reads input data from the input / output device and executes the programs on the execution area and the non-execution area, a normal range setting file for setting a normal range of an output value of the arithmetic processing unit by the program in the non-execution area of ​​the control device of the standby system; a determination processing unit that compares an output value of the arithmetic processing unit by the program of the non-execution area of ​​the control device of the standby system with an output value described in the normal range setting file, and determines whether or not to continue the rewriting work of the program of the non-execution area of ​​the control device of the standby system, When the program for controlling the controlled device is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, When the determination processing unit determines that the rewriting operation is to be continued, After swapping the execution region and the non-execution region of the standby control device, the equivalence processing unit of the standby control device equivalences the contents of the execution region of the standby control device with the contents of the non-execution region; performing standby switching so that the control device of the control system is a standby control device and the control device of the standby system is a control device of the control system; The equivalence processing unit of the control device which has become the standby system as a result of the standby switching equivalences the contents of the execution region of the control device which has become the standby system with the contents of the non-execution region. The method for rewriting a program of a plant instrumentation control system disclosed in the present application includes: a duplicated control device in which a control device of a control system which controls a controlled device and a standby control device as a backup device for the control device of the control system are duplicated; an input / output device that inputs and outputs to the duplicated control device; an engineering tool for editing the programs of the two control devices of the duplicated control device and engineering data used by the two control devices; Each of the control devices has a first program memory area for storing a program of the control device and a second program memory area for storing the program of the control device, and when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area for not controlling the controlled device, and the execution area and the non-execution area are interchangeable. an equivalence processing unit that equivalences the contents of the execution region with the contents of the non-execution region; a processor that reads input data from the input / output device and executes the program on the execution area and the non-execution area, When the program for controlling the controlled device is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, a first rewriting step of rewriting the program in the non-execution area of ​​the standby control device with an updated program; a first equivalence step of equivalencing the contents of the execution region of the standby control device with the contents of the non-execution region of the standby control device; a standby switching process for setting the control device of the control system as a standby control device and setting the control device of the standby system as a control device of the control system; a second rewriting step of rewriting the program in the non-execution area of ​​the current standby control device with the updated program; and a second equivalence step of equivalencing the contents of the execution region of the current standby control unit with the contents of the non-execution region of the standby control unit. Effect of the Invention

[0008] According to the method for rewriting a program for a plant instrumentation control system disclosed in the present application, An updated program is written to the standby control device, and the operation results of both programs before and after the update are compared and verified. If an error is found in the program and it is necessary to revert to the state before the update, it can be easily restored.

[0009] In addition, even if an abnormality occurs due to external disturbance or other factors when an updated program is written to the standby control device and operational verification of the updated program is not yet completed, and switching between the control system and the standby system is performed between the control devices, the unverified updated program will not be put into actual operation. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram showing a configuration of a plant instrumentation control system according to a first embodiment. [Diagram 2] FIG. 2 is an enlarged view of a main part of FIG. [Diagram 3] FIG. 2 is an enlarged view of a main part of FIG. [Figure 4] 5 is a diagram for explaining a method for rewriting a program of the redundant control device according to the first embodiment in chronological order. FIG. [Diagram 5] 5 is a diagram for explaining a method for rewriting a program of the redundant control device according to the first embodiment in chronological order. FIG. [Figure 6] 5 is a diagram for explaining a method for rewriting a program of the redundant control device according to the first embodiment in chronological order. FIG. [Figure 7] 5 is a diagram for explaining a method for rewriting a program of the redundant control device according to the first embodiment in chronological order. FIG. [Figure 8] 10 is a diagram for explaining a method for rewriting a program of a redundant control device according to a second embodiment in a chronological order. FIG. [Figure 9] 10 is a diagram for explaining a method for rewriting a program of a redundant control device according to a second embodiment in a chronological order. FIG. [Figure 10] 13 is a diagram for explaining a method for rewriting a program of a redundant control device according to a third embodiment in chronological order. FIG. [Figure 11] 13 is a diagram for explaining a method for rewriting a program of a redundant control device according to a third embodiment in chronological order. FIG. [Figure 12] 13 is a diagram for explaining a method for rewriting a program of a redundant control device according to a third embodiment in chronological order. FIG. [Figure 13]13 is a diagram for explaining a method for rewriting a program of a redundant control device according to a fourth embodiment in chronological order. FIG. [Figure 14] FIG. 14 is an enlarged view of a main part of FIG. [Figure 15] 13 is a diagram for explaining a method for rewriting a program of a redundant control device according to a fourth embodiment in chronological order. FIG. [Figure 16] 13 is a diagram for explaining a method for rewriting a program of a redundant control device according to a fourth embodiment in chronological order. FIG. [Figure 17] 13 is a diagram for explaining a method for rewriting a program of a redundant control device according to a fourth embodiment in chronological order. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Embodiment 1 Hereinafter, the plant instrumentation control system and the method of rewriting a program for the plant instrumentation control system according to the first embodiment will be described with reference to the drawings. FIG. 1 is a diagram showing the configuration of a plant instrumentation control system 100. 2 and 3 are enlarged views of the main part of FIG. The plant instrumentation control system 100 comprises a duplicated control device 10 which controls controlled devices of a plant (not shown) and is duplicated; an input / output device 20 which inputs and outputs data between the duplicated control device 10; an engineering tool 30 which edits the control programs (hereinafter simply referred to as programs) of the two control devices 10A and 10B which constitute the duplicated control device 10 and engineers various data used by the control devices 10A and 10B; and a maintenance network 50 which connects the duplicated control device 10, the input / output device 20, the engineering tool 30, and the above-mentioned controlled devices to communicate with each other.

[0012] The redundant control device 10 includes a control device 10A and a control device 10B. The control device 10A and the control device 10B are so-called redundant control devices, and one of them serves as a control device of a control system for plant control, and the other serves as a standby control device as a backup device. The standby control device is provided to back up the control system control device when updating the programs of the control devices 10A and 10B of the redundant control device 10, or when a sudden malfunction occurs in the control system control device.

[0013] Next, the configuration of the control device 10A will be described. The control device 10A includes an equivalence processing unit 11A, a storage device 12A, and an arithmetic processing unit 13A.

[0014] The storage device 12A includes duplicated memory areas, that is, a program memory area 12AP1 (first program memory area) and a program memory area 12AP2 (second program memory area) for storing programs for the control device 10A. The equivalence processing unit 11A performs equivalence between the program memory area 12AP1 and the program memory area 12AP2. The arithmetic processing unit 13A reads input data from the input / output device 20, executes the programs on the program memory areas 12AP1 and 12AP2, and outputs output data to the input / output device 20.

[0015] In addition, one of the program memory areas 12AP1 and 12AP2 becomes an execution area for performing plant control (control of the controlled device), and at that time, the other becomes a non-execution area for not performing plant control. However, the execution area of ​​the standby control device is a program memory area scheduled to perform plant control when standby switching occurs, in which the control system and standby system of the redundant control device 10 are switched. The program memory area that becomes a non-execution area is used when updating the program of the control device 10A, the details of which will be described later.

[0016] Next, the configuration of the control device 10B will be described. The control device 10B includes an equivalence processing unit 11B, a storage device 12B, and an arithmetic processing unit 13B.

[0017] The storage device 12B includes duplicated memory areas, that is, a program memory area 12BP1 (first program memory area) and a program memory area 12BP2 (second program memory area), which store programs for the control device 10B. The equivalence processing unit 11B performs equivalence between the program memory area 12BP1 and the program memory area 12BP2. The arithmetic processing unit 13B reads input data from the input / output device 20, executes the programs on the program memory areas 12BP1 and 12BP2, and outputs output data to the input / output device 20.

[0018] In addition, one of the program memory areas 12BP1 and 12BP2 is an execution area for performing plant control, and the other is a non-execution area for not performing plant control. The program memory area that is the non-execution area is used when updating the program of the control device 10B, the details of which will be described later.

[0019] The engineering tool 30 includes a program editor / monitor unit 31 that provides editor and monitor functions for programs running on the control devices 10A, 10B, and an output list display unit 32 that displays a list of output results calculated by the calculation processing units 13A, 13B of the control devices 10A, 10B, and provides a function for checking the difference between the output results of both systems.

[0020] Next, a method for online rewriting a program of the duplex control device 10 will be described with reference to FIGS. 4 to 7 are diagrams for explaining a method for rewriting a program of the duplex control device 10 in chronological order. In FIG. 4, in the redundant control device 10, the control device 10A operates as a control system control device, and the control device 10B operates as a standby system control device.

[0021] The same program is written in the program memory areas 12AP1 and 12AP2 of the storage device 12A of the control device 10A, and in the program memory areas 12BP1 and 12BP2 of the storage device 12B of the control device 10B. That is, the same program runs in the control devices 10A and 10B, and further, the program memory areas of the control devices 10A and 10B are duplicated.

[0022] In reality, each of the programs in the four program memory areas 12AP1, 12AP2, 12BP1, and 12BP2 operates using input information from the input / output device 20, but only the program in the program memory area 12AP1 of the control device 10A operating as the control system outputs the calculation results to the input / output device 20 and controls the plant.

[0023] As described above, FIG. 4 shows a state in which the program on the program memory area 12AP1 of the control device 10A controls the plant. In the unlikely event that a malfunction occurs in the control device 10A, the control device 10B is on standby (the program is running but no output is being performed). When the control device 10B is switched to the control device of the control system, the program on the program memory area 12BP1 of the storage device 12B operates as the control system.

[0024] When updating the program of the duplex control device 10, the program is updated in the following procedure. First, the operator creates an updated version of the program NP for the redundant control device 10 using the program editor and monitor unit 31 of the engineering tool 30. After completing the creation of the updated version of the program NP, first, the operator writes the program NP to the program memory area 12BP2 of the non-execution area of ​​the control device 10B, which is the current standby control device (P1 in FIG. 4: first rewrite step).

[0025] Thereafter, the program editor / monitor unit 31 of the engineering tool 30 displays (P2 in FIG. 4) the monitoring results of the pre-update program in the program memory area 12AP1 of the control device 10A currently operating as the control system control device, and the updated program NP in the program memory area 12BP2 of the control device 10B operating as the standby system control device. In addition, the output list display unit displays a list of output results of the calculations of the pre-update program in the program memory area 12AP1 and the updated program NP in the program memory area 12BP2 (P3 in FIG. 4). Then, the operator uses the output result list to check the soundness of the updated program NP (first comparison step).

[0026] If the operator checks and finds that there is no problem with the updated program NP, the operator continues rewriting the updated program NP from the engineering tool 30, and the engineering tool 30 issues a processing command to the standby system control device 10B to switch the execution area and non-execution area of ​​the program memory areas 12BP1, 12BP2 (first execution area switching process).

[0027] The standby control device 10B that has received the command switches the execution area and non-execution area of ​​the program memory, and the execution area is switched from the program memory area 12BP1 to the program memory area 12BP2. After the switching of the execution area is completed, the equivalence processing unit 11B equivalences the program memory area 12BP2 and the program memory area 12BP1, and the updated program NP is also reflected in the program memory area 12BP1 (P4 in FIG. 5: first equivalence step).

[0028] After completing the writing operation of the updated program NP to the standby control device 10B in this manner, the control system and standby system of the duplicated control device 10 are switched, so that the control device 10A becomes the standby system control device and the control device 10B becomes the control system control device (P5 in FIG. 6: standby switching process).

[0029] Next, the updated program is written to the program memory area 12AP2, which is a non-execution area, of the control device 10A, which is the current standby control device. First, the updated program NP is written to the program memory area 12AP2 of the non-execution area of ​​the control device 10A (P6 in FIG. 6: second rewrite step). After that, the program editor / monitor unit 31 of the engineering tool 30 displays the monitoring results of the updated program NP in the program memory area 12BP2 of the control device 10B, which is the current execution area of ​​the control system, and the updated program NP in the program memory area 12AP2 of the non-execution area of ​​the standby system (P7 in FIG. 6). Also, the output list display unit 32 displays a list of the output results of the calculations of the updated program NP in the program memory area 12BP2 of the control system and the updated program NP in the program memory area 12AP2 of the standby system (P8 in FIG. 6), allowing the operator to check the soundness of the updated program NP written to the program memory area 12AP2 of the standby system (second comparison step).

[0030] If the operator checks and finds that there is no problem with the updated program NP in the program memory area 12AP2, the operator continues the rewriting from the engineering tool 30, and the engineering tool 30 issues an execution area switching processing command to the control device 10A (second execution area replacement process).

[0031] The control device 10A, which is the standby system, switches between the execution area and the non-execution area of ​​the program memory, and the execution area is switched from the program memory area 12AP1 to the program memory area 12AP2. After the execution area switching is completed, the equivalence processing unit 11A equivalences the program memory area 12AP2 and the program memory area 12AP1, and the updated program NP is also reflected in the program memory area 12AP1 (P9 in FIG. 7: second equivalence step).

[0032] According to the plant instrumentation control system and the method for rewriting a program for the plant instrumentation control system of embodiment 1, the program memory areas of the control devices 10A, 10B are duplicated and a verification means is provided in the engineering tool 30, which enables an operator to verify the integrity and safely rewrite the program in the further duplicated program memory area of ​​the duplicated control device 10 during operation.

[0033] Embodiment 2 The plant instrumentation control system and the method for rewriting a program for the plant instrumentation control system according to the second embodiment will be described below, focusing on the differences from the first embodiment. In the first embodiment, a case was described in which checking the soundness of the updated program NP revealed that there was no problem with the updated program NP. In the second embodiment, however, by providing a write cancellation function to the duplication control device 10, it is possible to automatically restore the state before writing.

[0034] 8 and 9 are diagrams for explaining a method for rewriting a program of the duplex control device 10 in chronological order. As shown in FIG. 8, an updated program NP is written (P1 in FIG. 8), and if the result of checking its soundness (P2, P3 in FIG. 8) reveals a problem with the updated program NP, the operator can cancel the writing (P24 in FIG. 9), which causes a cancellation function (not shown) of the duplex control device 10 to operate.

[0035] In the control device cancellation function, the data in program memory area 12BP1 which holds the pre-update program of control device 10B, which is the standby system, is made correct, program memory areas BP1 and BP2 are made equivalent, the pre-update program of program memory area BP1 is reflected in program memory area BP2 (P25 in Figure 9), and control device 10B can be returned to the state before the updated program was written.

[0036] Conventionally, when restoring to the state before a program was written, an operator had to prepare a pre-update program and write the pre-update program, but in the second embodiment, the restoration itself is performed automatically.

[0037] According to the plant instrumentation control system and the method for rewriting a program for the plant instrumentation control system of embodiment 2, even if the updated program NP does not operate normally, the duplicated control device 10 can be easily restored to its original state.

[0038] Embodiment 3 The plant instrumentation control system and the method for rewriting a program for the plant instrumentation control system according to the third embodiment will be described below, focusing on the differences from the first and second embodiments. In the second embodiment, the case has been described in which the soundness of the updated program NP is checked, and if the updated program NP is not sound, the operator cancels writing. In this embodiment, a case will be described in which it is necessary to stop rewriting the updated program NP due to an event other than a problem with the updated program NP, such as a disturbance.

[0039] 10 to 12 are diagrams for explaining a method for rewriting a program of the duplex control device 10 in chronological order. As shown in FIG. 10, after writing of the updated program NP into the program memory area 12BP2 of the standby control device 10B is completed (P1 in FIG. 10), if an abnormality occurs in the control device 10A of the control system due to a factor such as a disturbance before the operator has verified the operation of the updated program NP, and a standby switchover of the duplicated control device 10 is performed (P2 in FIG. 11), the control device 10A becomes the standby control device and the control device 10B becomes the control system control device, but the control device 10B of the control system will perform calculations using the program before the update in the program memory area 12BP1 (P3 in FIG. 12).

[0040] Conventionally, when a standby switchover of the duplicated control device is performed after writing of the updated program NP to the standby control device is completed, the control device which has become the new control system performs calculations using the updated program NP, and therefore, if there is a problem with the updated program NP, there is a risk of the duplicated control device malfunctioning. However, according to the instrumentation control system of embodiment 3, the program memory area is duplicated for both the control device of the control system and the standby control device, thereby making it possible to prevent malfunction of the duplicated control device 10.

[0041] Embodiment 4 The plant instrumentation control system and the method for rewriting a program for the plant instrumentation control system according to the fourth embodiment will be described below, focusing on the differences from the first to third embodiments. In the first to third embodiments, a case has been described in which after the updated program NP is written to the program memory area 12BP2 of the standby control device 10B, the operator visually checks the output of the calculation results, etc., and operates the engineering tool 30 each time to perform the rewriting work of the updated program NP.

[0042] In the fourth embodiment, the operator does not need to operate the engineering tool 30 each time, and the rewriting work of the updated program NP can be performed automatically.

[0043] 13 and 15 to 17 are diagrams for explaining a method for rewriting a program of the duplex control device 10 in chronological order. FIG. 14 is an enlarged view of a main portion of FIG. The engineering tool 30 includes an automatic judgment processing unit 33 and a normal range setting file 34 .

[0044] The normal range setting file 34 is a file in which normal ranges (lower limit value and upper limit value) of various output values ​​of the updated program NP are set in advance. The automatic judgment processing unit 33 reads the normal range setting file 34 in advance (P40 in FIG. 13), and after writing the updated program NP to the program memory area 12BP2 (P1 in FIG. 13), the automatic judgment processing unit 33 judges whether the output result of the calculation of the calculation processing unit 13B is within the normal range of the normal range setting file 34 or not, and automatically judges whether or not to continue the rewriting work of the updated program NP (P43 in FIG. 13). If the rewriting is to be continued, the execution area and non-execution area of ​​the control device 10B of the standby system are swapped, and the program memory area 12BP1 is made equivalent to the program memory area 12BP2 (P45 in FIG. 15).

[0045] Next, the standby switching between the control device 10A and the control device 10B of the redundant control device 10 is automatically executed (P46 in FIG. 16). Next, after the updated program is automatically written to the program memory area 12AP2 of the control device 10A (P47 in FIG. 16), the automatic judgment processing unit 33 judges whether the output result of the calculation by the calculation processing unit 13A is within the normal range of the normal range setting file 34, and automatically judges whether or not to continue the rewriting work of the updated program NP (P48 in FIG. 16). If the rewriting is to be continued, the execution area and the non-execution area of ​​the standby control device 10A are swapped, and the program memory area 12AP1 is made equivalent to the program memory area 12AP2 (P50 in FIG. 17).

[0046] As a result, even if there is a large amount of change in the updated program NP, it is possible to prevent the updated program NP from being written as is due to an operator's mistake in visual confirmation, etc., which would cause the duplex control device 10 to malfunction. In addition, since the operator does not need to operate the program each time, the efficiency of the work of rewriting the updated program NP can be improved.

[0047] Although the present application describes various exemplary embodiments and examples, the various features, aspects, and functions described in one or more embodiments are not limited to application to a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless modifications not exemplified are assumed within the scope of the technology disclosed in this application, including, for example, modifying, adding, or omitting at least one component, and further, extracting at least one component and combining it with a component of another embodiment. [Explanation of symbols]

[0048] 100 Plant instrumentation control system, 10 Duplex control device, 10A, 10B control device, 11A, 11B equivalence processing unit, 12A,12B storage device, 12AP1, 12AP2, 12BP1, 12BP2 program memory area, 13A, 13B arithmetic processing unit, 20 input / output device, 30 engineering tool, 31 program editor / monitor section, 32 output list display section, 33 automatic judgment processing section, 34 normal range configuration files, 50 maintenance network.

Claims

1. a duplicated control device in which a control device of a control system which controls a controlled device and a standby control device as a backup device for the control device of the control system are duplicated; an input / output device that inputs and outputs to the duplicated control device; an engineering tool for editing programs of the two control devices of the duplicated control device and engineering data used by the two control devices; Each of the control devices has a first program memory area for storing a program of the control device and a second program memory area for storing the program of the control device, and when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area for not controlling the controlled device, and the execution area and the non-execution area are interchangeable. a processor that reads input data from the input / output device and executes the programs on the execution area and the non-execution area, When the program for controlling the controlled device is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, rewriting the program in the non-execution area of ​​the control device of the standby system with an updated program; Upon receiving an instruction input from an operator of the engineering tool indicating that there is no problem with the updated program, the plant instrumentation control system swaps the execution area and the non-execution area of ​​the standby system control device, and then performs standby switching to make the control system control device a standby system control device and the standby system control device a control system control device.

2. Each of the control devices includes an equivalence processing unit that equivalences the contents of the execution region with the contents of the non-execution region; After swapping the execution region and the non-execution region of the standby control device, the equivalence processing unit of the standby control device equivalences the contents of the execution region of the standby control device with the contents of the non-execution region; A plant instrumentation control system as described in claim 1, wherein after the updated program is written to the non-execution area of ​​the control device that has become the current standby system due to the standby switch, the equivalence processing unit of the control device that has become the current standby system equivalences the contents of the execution area of ​​the control device that has become the current standby system with the contents of the non-execution area.

3. a duplicated control device in which a control device of a control system which controls a controlled device and a standby control device as a backup device for the control device of the control system are duplicated; an input / output device that inputs and outputs to the duplicated control device; an engineering tool for editing programs of the two control devices of the duplicated control device and engineering data used by the control devices; Each of the control devices has a first program memory area for storing a program of the control device and a second program memory area for storing the program of the control device, and when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area for not controlling the controlled device, and the execution area and the non-execution area are interchangeable. an equivalence processing unit that equivalences the contents of the execution region with the contents of the non-execution region; a processor that reads input data from the input / output device and executes the programs on the execution area and the non-execution area, a normal range setting file for setting a normal range of an output value of the arithmetic processing unit by the program in the non-execution area of ​​the control device of the standby system; a determination processing unit that compares an output value of the arithmetic processing unit by the program of the non-execution area of ​​the control device of the standby system with an output value described in the normal range setting file, and determines whether or not to continue the rewriting work of the program of the non-execution area of ​​the control device of the standby system, When the program for controlling the controlled device is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, When the determination processing unit determines that the rewriting operation is to be continued, After swapping the execution region and the non-execution region of the standby control device, the equivalence processing unit of the standby control device equivalences the contents of the execution region of the standby control device with the contents of the non-execution region; performing standby switching so that the control device of the control system is a standby control device and the control device of the standby system is a control device of the control system; In the plant instrumentation control system, the equivalence processing unit of the control device that has become a standby system due to the standby switching equivalences the contents of the execution region of the control device that has become the standby system with the contents of the non-execution region.

4. a duplicated control device in which a control device of a control system which controls a controlled device and a standby control device as a backup device for the control device of the control system are duplicated; an input / output device that inputs and outputs to the duplicated control device; an engineering tool for editing programs of the two control devices of the duplicated control device and engineering data used by the two control devices; Each of the control devices has a first program memory area for storing a program of the control device and a second program memory area for storing the program of the control device, and when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area for not controlling the controlled device, and the execution area and the non-execution area are interchangeable. an equivalence processing unit that equivalences the contents of the execution region with the contents of the non-execution region; a processor that reads input data from the input / output device and executes the program on the execution area and the non-execution area, When the program for controlling the controlled device is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, a first rewriting step of rewriting the program in the non-execution area of ​​the standby control device with an updated program; a first equivalence step of equivalencing the contents of the execution region of the standby control device with the contents of the non-execution region of the standby control device; a standby switching process for setting the control device of the control system as a standby control device and setting the control device of the standby system as a control device of the control system; a second rewriting step of rewriting the program in the non-execution area of ​​the current standby control device with the updated program; A method for rewriting a program of a plant instrumentation control system, which includes a second equivalence process for equivalencing the contents of the execution area of ​​a current standby control device with the contents of the non-execution area of ​​the standby control device.

5. a first comparison step of comparing an output result of the program in the execution area of ​​the control device of the current control system with an output result of the updated version program in the non-execution area of ​​the control device of the current standby system after the first rewriting step; A method for rewriting a program for a plant instrumentation control system as described in claim 4, further comprising the step of: executing a second comparison step after the second rewrite step, in which the output result of the program in the execution area of ​​the control device of the current control system is compared with the output result of the updated program in the non-execution area of ​​the control device of the current standby system.

6. A method for rewriting a program of a plant instrumentation control system as described in claim 5, wherein an execution domain swapping step is executed after each of the first rewriting step and the second rewriting step, in which the execution domain and the non-execution domain of the control device of the current standby system are swapped.

Images