Control system, plant system, controller, and control method

Abstract

To provide an effective system for achieving both quick switching from a main computer to a sub-computer and reduction in processing loads of the main computer and the sub-computer.SOLUTION: A control system 10 includes a main controller 100 and a sub-controller 200. The main controller 100 has a main processing part 113 that repeatedly and sequentially executes a plurality of processes to control a control target 2 in a control cycle regardless of the progress of a plurality of processes performed by the sub-controller 200, and the sub-controller 200 has: a sub-processing part 213 that sequentially executes a plurality of processes following the progress of the plurality of processes performed by the main processing part 113; and a switching part 214 that, upon cancellation of the plurality of processes due to abnormality by the main processing part 113, causes the sub-processing part 213 to continuously execute the plurality of processes regardless of the progress of the plurality of processes performed by the main processing part 113 and start control of the control target 2 performed by the sub-processing part 213.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to a control system, a plant system, a controller, and a control method. [Background technology]

[0002] Patent Document 1 discloses a controller redundancy system. In the controller redundancy system, each controller has an execution order storage means for storing the execution order of each calculation in advance, a status notification means for notifying the other controller of the calculation execution status in the own controller at a predetermined time, a timing confirmation means for determining whether the calculation execution status of the own controller is behind, ahead of, or the same as the other controller based on the calculation execution status notified from the other controller and the execution order storage means, and a deviation correction means for executing calculations until the calculation execution status of the own controller becomes the same as that of the other controller and notifying the other controller of a completion notification of the completion of execution when the timing confirmation means determines that the own controller is behind the other controller. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-170053 A Summary of the Invention [Problem to be solved by the invention]

[0004] The present disclosure provides a system that is effective in achieving both rapid switching from a main controller to a sub-controller when an abnormality occurs and reduced processing load on the main controller and the sub-controller. [Means for solving the problem]

[0005] A control system according to one aspect of the present disclosure comprises a main controller that controls a control object, and a sub-controller that controls the control object on behalf of the main controller when an abnormality occurs in the main controller, wherein the main controller has a main processing unit that repeats, in a control period, the sequential execution of multiple processes to control the control object regardless of the progress of the multiple processes by the sub-controller, and the sub-controller has a sub-processing unit that sequentially executes the multiple processes in accordance with the progress of the multiple processes by the main processing unit, and a switching unit that, when the main processing unit stops the multiple processes due to an abnormality, causes the sub-processing unit to continue executing the multiple processes regardless of the progress of the multiple processes by the main processing unit, and starts control of the control object by the sub-processing unit.

[0006] A controller according to another aspect of the present disclosure is a controller that constitutes a redundant control system together with other controllers, and includes a mode selection unit that selects either a main mode or a sub mode based on a predetermined setting, a processing unit that, in the main mode, repeats in a control period the sequential execution of multiple processes to control the control target regardless of the progress of the multiple processes by the other controllers, and, in the sub mode, sequentially executes the multiple processes in accordance with the progress of the multiple processes by the other controllers, and a switching unit that causes the mode selection unit to select the main mode in the sub mode when the other controller stops the multiple processes due to an abnormality.

[0007] A control method according to yet another aspect of the present disclosure includes: in a main controller which constitutes a redundant system together with a sub-controller, repeating in a control period the sequential execution of multiple processes to control a control object regardless of progress of the multiple processes by the sub-controller; in the sub-controller, sequential execution of the multiple processes in accordance with the progress of the multiple processes by the main controller; and, when the main controller stops the multiple processes due to an abnormality, continuing the execution of the multiple processes regardless of progress of the multiple processes by the main controller and starting control of the control object. Effect of the Invention

[0008] According to the present disclosure, it is possible to provide a system that is effective in achieving both rapid switching from the main controller to the sub-controller when an abnormality occurs and reduced processing load on the main controller and the sub-controller. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram illustrating a configuration of a plant system. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a functional configuration of a duplicated CPU module. [Diagram 3] FIG. 13 is a block diagram showing a modified example of a duplicated CPU module. [Figure 4] FIG. 2 is a block diagram illustrating an example of the functional configuration of a dual-purpose CPU module. [Diagram 5] FIG. 2 is a diagram illustrating an example of a hardware configuration of a CPU module. [Figure 6] 11 is a flowchart illustrating a first processing procedure of a main controller and a sub-controller in redundant control. [Figure 7] 11 is a flowchart illustrating a first processing procedure of a main controller and a sub-controller in redundant control. [Figure 8] 11 is a flowchart illustrating a first processing procedure of a main controller and a sub-controller in redundant control. [Figure 9] 11 is a flowchart illustrating a switching procedure for dealing with an abnormality that occurs during a first processing procedure. [Figure 10] 11 is a flowchart illustrating a switching procedure for dealing with an abnormality that occurs during a first processing procedure. [Figure 11] 11 is a flowchart illustrating a switching procedure for dealing with an abnormality that occurs during a first processing procedure. [Figure 12] 10 is a flowchart illustrating a notification procedure when an abnormality occurs in the sub-controller. [Figure 13] 11 is a flowchart illustrating a second processing procedure of the main controller and the sub-controller in redundant control. [Figure 14] 11 is a flowchart illustrating an example of an interruption of a first processing procedure in a second processing procedure. [Figure 15] 11 is a flowchart illustrating a switching procedure for dealing with an abnormality that occurs during a second processing procedure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, the embodiments will be described in detail with reference to the drawings. In the description, the same elements or elements having the same functions are denoted by the same reference numerals, and duplicated description will be omitted.

[0011] [Plant Systems] 1 includes a plant 2 to be controlled, and a control system 10 that controls the plant 2. Examples of the plant 2 include water treatment plants (e.g., water purification and sewage treatment), steel-related plants, paper manufacturing plants, and film manufacturing plants.

[0012] The plant 2 includes at least one input device 21 that detects a state of the plant 2, and at least one output device 22 that changes the state of the plant 2. Examples of the input device 21 include sensors that acquire the temperature, humidity, pressure, operating speed, etc. of the plant 2, and switches that detect contact. Examples of the output device 22 include a power source such as a motor or a solenoid. The output device 22 may include a motor and a local controller that controls the motor. The control system 10 controls the at least one output device 22 based on information acquired from the at least one input device 21 so as to bring the state of the plant 2 closer to a target state.

[0013] The plant 2 may further include peripheral devices in addition to at least one input device 21 and at least one output device 22. Examples of the peripheral devices include an HMI 31 (Human Machine Interface) and a host controller 32. The HMI 31 is a terminal device that displays information to an operator and acquires input from the operator. For example, the HMI 31 has a display device such as a liquid crystal monitor and an input device such as an input key set. The host controller 32 supplies upper level commands including, for example, the above-mentioned change schedule of the target state to the control system 10.

[0014] For example, a control system 10 has two power modules 12 and 13, two CPU modules 100 and 200, at least one option module 14, and a mount base 11. The power module 12 generates power for control. For example, the power module 12 converts power from a commercial power source into power for control. When an abnormality occurs in the power module 12, the power module 13 generates power for control instead of the power module 12.

[0015] The CPU modules 100, 200 and at least one option module 14 operate using control power generated by the power module 12 or the power module 13. The CPU module 100 (main controller) controls the plant 2. For example, the CPU module 100 acquires detection results of the state of the plant 2 from at least one input device 21 via at least one option module 14, and outputs control commands based on the acquired detection results to at least one output device 22. The CPU module 100 also communicates with the above-mentioned peripheral devices via at least one option module 14.

[0016] The CPU module 200 (sub-controller) controls the plant 2 in place of the CPU module 100 when an abnormality occurs in the CPU module 100. For example, the CPU module 200, in place of the CPU module 100, acquires detection results of the state of the plant 2 from at least one input device 21 via at least one option module 14, and outputs a control command based on the acquired detection results to at least one output device 22. The CPU module 200 also communicates with peripheral devices via at least one option module 14 in place of the CPU module 100.

[0017] The option module 14 inputs and outputs information to and from the plant 2 in response to a request from the CPU module 100 or the CPU module 200. In the illustrated example, the control system 10 has an I / O module 14A, a communication module 14B, a communication module 14C, and a communication module 14D as a plurality of option modules 14. The I / O module 14A inputs and outputs information to and from the input device 21 and the output device 22. The communication module 14B performs network communication between the local controller of the output device 22 and the HMI 31. The communication module 14C performs network communication with the remote I / O module 15. The remote I / O module 15 inputs and outputs information to and from the input device 21 and the output device 22 at a position away from the control system 10. The communication module 14D performs network communication with the host controller 32. The illustrated configuration is merely an example, and the number, type, and connection destination of the option modules 14 can be changed depending on the contents of control, etc.

[0018] As illustrated above, according to the control system provided with redundancy by the CPU modules 100 and 200, even if an abnormality occurs in the CPU module 100, the CPU module 200 can continue to control the plant 2. If there is a large time lag until the control by the CPU module 100 is taken over by the CPU module 200, the state of the plant 2 may deviate from the target state during the time lag, and the reliability of the control of the plant 2 may not be maintained.

[0019] In order to reduce such a time lag, it is conceivable to have the CPU module 100 and the CPU module 200 synchronously execute the same process while the CPU module 100 is normal, thereby seamlessly handing over the control by the CPU module 100 to the CPU module 200. However, in order to have the CPU module 100 and the CPU module 200 synchronously execute the same process, it is necessary for the CPU module 100 and the CPU module 200 to repeatedly monitor the progress of the other and adjust their own progress in accordance with the other's progress, which increases the processing load on the CPU module 100 and the CPU module 200. This load may also impose restrictions on resources for processing directly linked to the control of the plant 2.

[0020] Therefore, the CPU module 100 is configured to repeat, in a control period, the sequential execution of multiple processes to control the plant 2 regardless of the progress of the multiple processes by the CPU module 200, and the CPU module 200 is configured to sequentially execute the multiple processes in accordance with the progress of the multiple processes by the CPU module 100, and when the CPU module 100 stops the multiple processes due to an abnormality, to continue the execution of the multiple processes regardless of the progress of the multiple processes by the CPU module 100 and start controlling the plant 2.

[0021] According to such a configuration, the CPU module 100 does not adjust its own progress according to the progress of the other, so the load on the CPU module 100 and the CPU module 200 is reduced. The CPU module 200 executes a plurality of processes in sequence following the progress of the plurality of processes by the CPU module 100, so the switching time after the CPU module 100 stops a process remains the execution delay time of the CPU module 200 immediately before the CPU module 100 stops the process. The switching time is, for example, the time until the CPU module 200 starts the process that the CPU module 100 was scheduled to execute after the process was stopped. The execution delay time of the CPU module 200 is, for example, a delay time that occurs in the progress of the plurality of processes by the CPU module 200 with respect to the progress of the plurality of processes by the CPU module 100. As long as the CPU module 100 and the CPU module 200 complete a plurality of processes within a control period, the execution delay time returns to zero at each control period, so the execution delay time is maintained to be minute. Therefore, switching from CPU module 100 to CPU module 200 is performed quickly in a short time that is equal to or shorter than the minute execution delay time. Therefore, the control system 10 is effective in achieving both quick switching from CPU module 100 to CPU module 200 and reduction in the processing load of the CPU module 100 and the CPU module 200.

[0022] Below, the functional configuration of the CPU module 100 and the CPU module 200 will be illustrated with reference to Fig. 2. As shown in Fig. 2, the CPU module 100 has, as functional components (hereinafter referred to as "functional blocks"), a program storage unit 111, a main processing unit 113, a processing result storage unit 112, a main status transmission unit 114, and a diagnosis unit 115.

[0023] The program storage unit 111 stores a plurality of programs that respectively define a plurality of processes to be executed by the CPU module 100. Each of the plurality of programs is represented by, for example, a ladder diagram.

[0024] The main processing unit 113 repeats, in a control cycle, sequentially executing a plurality of processes to control the plant 2, regardless of the progress of the plurality of processes by the CPU module 200. For example, the main processing unit 113 sequentially executes a plurality of programs stored in the program storage unit 111 in response to an interrupt signal generated in each control cycle. The processing result storage unit 112 temporarily stores data generated by the main processing unit 113 in the process of executing the plurality of programs.

[0025] Sequentially executing a plurality of processes regardless of the progress of the plurality of processes by the CPU module 200 means that when the CPU module 100 itself completes one process, it starts the next process without waiting for the completion of the first process by the CPU module 200. Therefore, even if the CPU module 100 is configured to monitor the progress of a plurality of processes by the CPU module 200, this is included in the configuration in which the CPU module 100 sequentially executes a plurality of processes regardless of the progress of the plurality of processes by the CPU module 200, as long as the progress of the CPU module 100 is not adjusted based on the monitoring result.

[0026] The plurality of processes may include at least the following processes: Output process: outputting one or more output values; Input process: acquiring one or more input values; Calculation process: executing a calculation or the like that does not include input / output to the plant 2.

[0027] In the output processing, the main processing unit 113 outputs one or more output values ​​to the plant 2 via at least one option module 14. For example, the main processing unit 113 outputs an output value representing a control command to at least one output device 22. In the input processing, the main processing unit 113 acquires one or more input values ​​from the plant 2 via at least one option module 14 and stores them in the processing result storage unit 112. For example, the main processing unit 113 acquires detection results by at least one input device 21 as input values. The arithmetic processing may include input / output to the input device 21, input / output to the output device 22, or input / output to peripheral devices such as the HMI 31 and the host controller 32.

[0028] The multiple processes may include, in order, one or more output processes for outputting one or more output values ​​to the plant 2, one or more input processes for acquiring one or more input values ​​from the plant 2, and one or more arithmetic processes for calculating one or more output values ​​in the next control cycle based on the one or more input values. For example, the multiple processes may include, in order, multiple output processes for outputting multiple output values ​​to the plant 2, multiple input processes for acquiring multiple input values ​​from the plant 2, and multiple arithmetic processes for calculating multiple output values ​​in the next control cycle based on the multiple input values. The multiple output values ​​generated by the multiple arithmetic processes are stored in the processing result storage unit 112, and the multiple output values ​​output by the multiple output processes in the next control cycle are read out from the processing result storage unit 112, for example.

[0029] The main status transmission unit 114 sequentially transmits a completion notification for each process to the CPU module 200 as the progress of multiple processes. The main status transmission unit 114 may transmit the completion notification for each process at least before the completion of the next process. For example, the main status transmission unit 114 may transmit the completion notification when each process is completed, or may transmit the completion notification for each process when the next process starts. There are no particular limitations on the content of the transmission for notifying the completion. For example, the content of the transmission may include identification information of the completed process.

[0030] The diagnosis unit 115 diagnoses whether or not there is an abnormality in the CPU module 100 based on the execution result of a predetermined diagnosis process. Examples of the diagnosis contents include a diagnosis of a CPU abnormality, a diagnosis of an input / output abnormality, a diagnosis of a memory abnormality, and a diagnosis of a power supply abnormality. The main status transmission unit 114 may include the diagnosis result by the diagnosis unit 115 in the transmission content of the completion notification. When the diagnosis unit 115 diagnoses that there is an abnormality in the CPU module 100, the main status transmission unit 114 may transmit an abnormality notification to the CPU module 200.

[0031] The CPU module 200 has, as functional blocks, a program storage unit 211, a sub-processing unit 213, a processing result storage unit 212, a switching unit 214, and a notification unit 215. The program storage unit 211 stores the multiple programs stored in the program storage unit 111.

[0032] The sub-processing unit 213 executes a plurality of processes in sequence, following the progress of the plurality of processes executed by the main processing unit 113. For example, the sub-processing unit 213 executes a plurality of processes in sequence, such that the start timing of each process does not precede the start timing of the main processing unit 113, and at least a part of the execution period of each process overlaps with the execution period of the main processing unit 113. For example, the sub-processing unit 213 executes one process, and executes the next process after receiving a completion notification of the same one process, thereby executing a plurality of processes in sequence, following the progress of the plurality of processes executed by the main processing unit 113. By waiting for a completion notification for each process, the progress of the plurality of processes executed by the sub-processing unit is more reliably maintained in a state where it follows the progress of the plurality of processes executed by the main processing unit. This makes it possible to prevent, for example, the process to be executed for the control target or the like after switching from being omitted due to the process executed by the sub-processing unit being executed first.

[0033] For example, the sub-processing unit 213 acquires from the CPU module 100 the interrupt signal to which the main processing unit 113 responds, and executes the first of the multiple programs stored in the program storage unit 211 in response to the acquired interrupt signal. The sub-processing unit 213 then executes one program, and after receiving a completion notification for the same one program, executes the next program. The processing result storage unit 212 temporarily stores data generated by the sub-processing unit 213 in the process of executing the multiple programs.

[0034] In the output process, the sub-processing unit 213 may execute the next process in response to completion of the output process by the main processing unit 113, without outputting one or more output values ​​to the plant 2. In the input process, the sub-processing unit 213 may acquire one or more input values ​​acquired by the main processing unit 113 from the CPU module 100. It is possible to reduce the communication load between the control system 10 and the plant 2, etc., while making the control system 10 redundant.

[0035] For example, when the multiple processes include multiple output processes, multiple input processes, and multiple arithmetic processes in that order, the sub-processing unit 213 acquires the interrupt signal to which the main processing unit 113 responds from the CPU module 100, and executes the first output process in response to the acquired interrupt signal. For example, the sub-processing unit 213 starts waiting for the completion of the output process by the main processing unit 113 as the output process. After receiving a completion notification of the output process by the main processing unit 113, the sub-processing unit 213 executes the next output process. The sub-processing unit 213 repeatedly waits for the completion of the output process until it receives a completion notification of the last output process (the last in the control period) by the main processing unit 113.

[0036] After receiving a completion notification of the last output process by the main processing unit 113, the sub-processing unit 213 executes the first input process. For example, the sub-processing unit 213 starts waiting for the completion of the input process by the main processing unit 113 as the input process. When the main processing unit 113 completes the input process, the main status transmission unit 114 transmits a completion notification including one or more input values ​​acquired by the main processing unit 113 to the CPU module 200. After receiving a completion notification of the input process by the main processing unit 113, the sub-processing unit 213 stores the one or more input values ​​included in the completion notification in the processing result storage unit 212. As a result, the one or more input values ​​stored in the processing result storage unit 212 are equalized to the one or more input values ​​stored in the processing result storage unit 112. Thereafter, the sub-processing unit 213 executes the next input process. The sub-processing unit 213 repeatedly waits for the completion of the input process until it receives a completion notification of the last input process (the last in the control period) by the main processing unit 113.

[0037] After receiving a notification of completion of the last input process by the main processing unit 113, the sub-processing unit 213 starts executing the first arithmetic process. If one or more output values ​​are generated by the arithmetic process, the sub-processing unit 213 stores the generated one or more output values ​​in the processing result storage unit 212. After completing its own arithmetic process and receiving a notification of completion of the arithmetic process by the main processing unit 113, the sub-processing unit 213 starts executing the next arithmetic process. After completing its own last arithmetic process (the last within a control period) and receiving a notification of completion of the last arithmetic process by the main processing unit 113, the sub-processing unit 213 starts waiting for the next interrupt signal.

[0038] As described above, the arithmetic processing may include input / output to the input device 21, input / output to the output device 22, or input / output to a peripheral device. Hereinafter, arithmetic processing including input is referred to as "arithmetic processing with input", and arithmetic processing including output is referred to as "arithmetic processing with output". In arithmetic processing with output, the sub-processing unit 213 may execute the next process in response to completion of output by the main processing unit 113 without performing any output. In arithmetic processing with input, the sub-processing unit 213 may acquire the input acquired by the main processing unit 113 from the CPU module 100 without performing any input.

[0039] When the CPU module 100 stops multiple processes due to an abnormality, the switching unit 214 causes the sub-processing unit 213 to continue execution of the multiple processes regardless of the progress of the multiple processes by the main processing unit 113, and causes the sub-processing unit 213 to start control of the plant 2. Starting control by the sub-processing unit 213 means causing the sub-processing unit 213 to start input / output with the plant 2.

[0040] For example, when the main processing unit 113 stops multiple processes due to an abnormality, the switching unit 214 causes the sub-processing unit 213 to output one or more output values ​​to the plant 2 in the output process. For example, when the main processing unit 113 stops multiple processes due to an abnormality, the switching unit 214 switches the execution content of the sub-processing unit 213 in the output process from waiting for the completion of the output process by the main processing unit 113 to outputting one or more output values ​​to the plant 2. In addition, when the main processing unit 113 stops multiple processes due to an abnormality, the switching unit 214 switches the acquisition destination of one or more input values ​​by the sub-processing unit 213 from the CPU module 100 to the plant 2.

[0041] The switching unit 214 may detect that the main processing unit 113 has stopped multiple processes due to an abnormality based on the delay in receiving the completion notification. By detecting the delay in receiving the completion notification transmitted for each process, it is possible to switch from the CPU module 100 to the CPU module 200 in a timely manner.

[0042] For example, when the length of time that the sub-processing unit 213 waits for a completion notification of one process (hereinafter referred to as "waiting time") exceeds a predetermined threshold, the switching unit 214 detects that the main processing unit 113 has stopped multiple processes due to an abnormality. This makes it possible to detect an abnormality in the CPU module 100 with higher reliability.

[0043] The start timing of the standby time is the timing at which the processing to be executed without waiting for receipt of a completion notification is completed. For example, in the above-mentioned output processing, the start timing of the standby time is the timing at which the standby time starts to wait for the completion of the output processing by the main processing unit 113. Similarly, in the above-mentioned input processing, the start timing of the standby time is the timing at which the standby time starts to wait for the completion of the input processing by the main processing unit 113. In the above-mentioned arithmetic processing, the start timing of the standby time is the timing at which the arithmetic processing by itself is completed.

[0044] The switching unit 214 may detect that the main processing unit 113 has stopped multiple processes due to an abnormality, further based on the above-mentioned abnormality notification from the main status transmission unit 114. By utilizing the notification from the CPU module 100, it is possible to more quickly switch from the CPU module 100 to the CPU module 200.

[0045] When the process stopped by the main processing unit 113 is output processing, the switching unit 214 may cause the sub-processing unit 213 to continue multiple processes from the start of the stopped output process. It is possible to quickly switch from the CPU module 100 to the CPU module 200 without interrupting the output process. In the output process, the sub-processing unit 213 reads out one or more output values ​​from the processing result storage unit 212 and outputs them to the plant 2.

[0046] When the process stopped by the main processing unit 113 is input processing, the switching unit 214 may cause the sub-processing unit 213 to continue multiple processes from the start of the stopped input processing. It is possible to quickly switch from the CPU module 100 to the CPU module 200 without interrupting the input processing. The sub-processing unit 213 stores one or more acquired input values ​​in the input processing in the processing result storage unit 212.

[0047] When the process stopped by the main processing unit 113 is a calculation process, the switching unit 214 may cause the sub-processing unit 213 to continue multiple processes without returning to the start of the stopped calculation process. When the stopped calculation process is the above-mentioned peripheral output process or peripheral input process, the switching unit 214 may cause the sub-processing unit 213 to continue multiple processes from the start of the stopped calculation process.

[0048] When the switching unit 214 detects that the main processing unit 113 has stopped multiple processes due to an abnormality, the notification unit 215 notifies the operator of the abnormality in the CPU module 100. For example, the notification unit 215 notifies the operator of the abnormality in the CPU module 100 by displaying on the HMI 31 via at least one option module 14.

[0049] The CPU module 100 may further include a second main processing unit 116. The second main processing unit 116 sequentially executes a plurality of second processes different from the plurality of processes over a plurality of periods in which the main processing unit 113 does not execute the plurality of processes, regardless of the progress of the plurality of second processes executed by the CPU module 200. The second main processing unit 116 may repeat the execution of the plurality of second processes in a second control period longer than the control period (hereinafter referred to as the "first control period"), and execute the plurality of second processes in each second control period over a plurality of periods in which the main processing unit 113 does not execute the plurality of processes. The plurality of second processes are processes that can be executed in a longer period than the plurality of processes in the first control period (hereinafter referred to as the "plurality of first processes"), such as sequence control in which the function of a relay circuit is replaced by software, or correction of control parameters based on a relatively long-term trend.

[0050] The program storage unit 111 may store a plurality of second programs each defining a plurality of second processes to be executed by the CPU module 100. Each of the plurality of second programs is represented, for example, by a ladder diagram shown in FIG. 1. The second main processing unit 116 sequentially executes the plurality of second programs stored in the program storage unit 111 in response to a second interrupt signal generated at each second control period. The processing result storage unit 112 temporarily stores data generated by the second main processing unit 116 in the process of executing the plurality of second programs.

[0051] The main status transmission unit 114 may sequentially transmit to the CPU module 200 a completion notification for each of the second processes as a progress of the multiple second processes.

[0052] When the CPU module 100 further includes a second main processing unit 116, the CPU module 200 may further include a second sub-processing unit 216. The second sub-processing unit 216 sequentially executes the second processes in accordance with the progress of the second processes executed by the second main processing unit 116 over multiple periods during which the sub-processing unit 213 does not execute the multiple processes.

[0053] The program storage unit 211 stores the multiple second programs stored in the program storage unit 111. The second sub-processing unit 216 acquires the second interrupt signal to which the sub-processing unit 213 responds from the CPU module 100, and executes the first second program of the multiple second programs stored in the program storage unit 211 in response to the acquired second interrupt signal. Thereafter, the second sub-processing unit 216 executes one second program, and after receiving a completion notification of the same one second program, executes the next second program. The processing result storage unit 212 temporarily stores data generated by the second sub-processing unit 216 in the process of executing the multiple second programs.

[0054] The second main processing unit 116 suspends the execution of the second processes when the main processing unit 113 executes the first processes in response to an interrupt signal (hereinafter referred to as the "first interrupt signal"). Similarly, the second sub-processing unit 216 suspends the execution of the second processes when the sub-processing unit 213 executes the first processes.

[0055] The progress of the multiple second processes by the second main processing unit 116 at the time of interruption may affect the results of the multiple first processes by the main processing unit 113. In this case, the progress of the multiple second processes by the second sub-processing unit 216 at the time of interruption also affects the results of the multiple first processes by the sub-processing unit 213.

[0056] For example, in at least one of the multiple cycles repeated in the first control period, the multiple first processes may include a process based on at least one result of the multiple second processes. Hereinafter, a process based on at least one result of the multiple second processes is referred to as a "related process." If the progress of the multiple second processes at the time of interruption is different between the second main processing unit 116 and the second sub-processing unit 216, the result of the related process by the main processing unit 113 may differ from the result of the related process by the sub-processing unit 213. For example, if the multiple second processes include adjustment of the control parameters, the related process by the main processing unit 113 and the related process by the sub-processing unit 213 may be executed based on different control parameters.

[0057] In order to prevent discrepancies between the results of the related processes by the main processing unit 113 and the sub-processing unit 213, it is possible to coordinate the progress of the second main processing unit 116 and the second sub-processing unit 216 after the first interrupt signal is generated, and then have the main processing unit 113 and the sub-processing unit 213 start a plurality of first processes. However, this causes variation in the time from the generation of the first interrupt signal to the start of the plurality of first processes, which impairs the regular periodicity of input / output from the CPU module 100 to the plant 2.

[0058] Therefore, the second main processing unit 116 and the second sub-processing unit 216 immediately suspend the multiple second processes in response to the first interrupt signal. After the multiple second processes are suspended, the main processing unit 113 and the sub-processing unit 213 immediately sequentially execute one or more output processes (e.g., multiple output processes) and one or more input processes (e.g., multiple input processes), and suspend the multiple first processes before the start of one or more arithmetic processes (e.g., multiple arithmetic processes). The second main processing unit 116 suspends the second process while at least the main processing unit 113 is executing one or more output processes and one or more input processes, and after the main processing unit 113 completes one or more output processes and one or more input processes, causes the main processing unit 113 to resume the multiple first processes (one or more arithmetic processes) after completing the suspended second process. The second sub-processing unit 216 suspends the second process while at least one output process and one or more input process are being executed by the sub-processing unit 213, and after the sub-processing unit 213 completes the one or more output processes and one or more input processes, causes the sub-processing unit 213 to resume multiple first processes (one or more calculation processes) after completing the suspended second process.

[0059] The main processing unit 113 and the sub-processing unit 213 each suspend multiple processes after executing input / output processing, and after aligning the progress of the processes of the second main processing unit 116 and the second sub-processing unit 216, the main processing unit 113 and the sub-processing unit 213 resume multiple processes. This prevents the difference in the progress of the processes of the second main processing unit 116 and the second sub-processing unit 216 from affecting the processes of the main processing unit 113 and the sub-processing unit 213 while maintaining the fixed periodicity of the input / output processing. By completing the second process that is suspended, the progress of the processes of the second main processing unit 116 and the second sub-processing unit 216 can be easily aligned. This makes it possible to improve the reliability of control while suppressing the processing load in the control system 10.

[0060] The CPU module 200 may further include a comparison unit 217. Based on the progress of a plurality of second processes by the second main processing unit 116, the comparison unit 217 compares the second process currently suspended in the second main processing unit 116 with the second process currently suspended in the second sub-processing unit 216. For example, the comparison unit 217 identifies the second process currently suspended in the second main processing unit 116 based on a completion notification of the second process already received from the CPU module 100. For example, the comparison unit 217 identifies the second process next to the second process corresponding to the latest completion notification as the second process currently suspended in the second main processing unit 116. The comparison unit 217 compares the identified second process with the second process currently suspended in the second sub-processing unit 216.

[0061] When the interrupted second process in the second main processing unit 116 is a second process subsequent to or subsequent to the interrupted second process in the second sub-processing unit 216, the second sub-processing unit 216 may cause the sub-processing unit 213 to resume the multiple first processes after completing one or more output processes and one or more input processes by the sub-processing unit 213 and completing up to the interrupted second process in the second main processing unit 116. Even when the second process interrupted by the second main processing unit 116 is different from the second process interrupted by the second sub-processing unit 216, the progress of the multiple second processes by the second main processing unit 116 can be used to easily align the progress by the second main processing unit 116 and the second sub-processing unit 216.

[0062] 3, the CPU module 200 may further include a sub-status transmission unit 221, and the CPU module 100 may further include a notification unit 121. The sub-status transmission unit 221 sequentially transmits a completion notification for each process to the CPU module 100 as a progress of the multiple processes performed by the CPU module 200. Even when the sub-status transmission unit 221 sequentially transmits a completion notification for each process to the CPU module 100, the main processing unit 113 sequentially executes the multiple first processes regardless of the progress of the multiple first processes performed by the CPU module 200.

[0063] The notification unit 121 notifies the operator that the sub-processing unit 213 has stopped multiple processes due to an abnormality, based on a delay in receiving the completion notification. For example, the notification unit 121 notifies the operator of the abnormality in the CPU module 200 by displaying the abnormality on the HMI 31 via at least one option module 14. By having the CPU module 100 notify the abnormality in the CPU module 200, it is possible to encourage rapid recovery of the redundant system while continuing control by the CPU module 100.

[0064] The CPU module 200 may further include a diagnosis unit 222. The diagnosis unit 222 diagnoses whether or not there is an abnormality in the CPU module 200 based on the execution result of a predetermined diagnosis process. Examples of the diagnosis contents include diagnosis of a CPU abnormality, diagnosis of an input / output abnormality, diagnosis of a memory abnormality, and diagnosis of a power supply abnormality. The secondary status transmission unit 221 may include the diagnosis result by the diagnosis unit 222 in the transmission content of the completion notification. When the diagnosis unit 222 diagnoses that there is an abnormality in the CPU module 200, the secondary status transmission unit 221 may transmit an abnormality notification to the CPU module 100.

[0065] Each of the CPU modules 100, 200 may be configured with a controller 300 that can be used by both the CPU module 100 and the CPU module 200 by changing the settings. Below, an example of a controller 300 that can be used by both the CPU module 100 and the CPU module 200 will be described.

[0066] 4, the controller 300 has, as functional blocks, a mode selection unit 321, a program storage unit 311, a processing unit 313, a processing result storage unit 312, a status transmission unit 314, a diagnosis unit 315, a second processing unit 316, a comparison unit 317, and a switching unit 322. The program storage unit 311 stores a plurality of first programs and a plurality of second programs. The mode selection unit 321 selects either a main mode or a sub mode based on a predetermined setting.

[0067] The program storage unit 311 stores the above-mentioned first programs and second programs. The program storage unit 311 functions as the above-mentioned program storage unit 111 in the main mode, and functions as the above-mentioned program storage unit 211 in the sub mode.

[0068] The processing unit 313 functions as the above-mentioned main processing unit 113 in the main mode, and functions as the above-mentioned sub-processing unit 213 in the sub mode. For example, in the main mode, the processing unit 313 repeats in a control period a process of sequentially executing a plurality of first processes to control a control target, regardless of the progress of a plurality of first processes (a plurality of first programs) by another controller (e.g., another controller 300 that has selected the sub mode), and in the sub mode, sequentially executes a plurality of first processes in accordance with the progress of the execution of a plurality of first processes by another controller (e.g., another controller 300 that has selected the main mode).

[0069] The second processing unit 316 functions as the above-mentioned second main processing unit 116 in the main mode, and functions as the above-mentioned second sub-processing unit 216 in the sub mode. For example, in the main mode, the second processing unit 316 repeats in a second control period the sequential execution of the second processes to control the control target, regardless of the progress of the second processes (the second programs) by the other controller (e.g., the other controller 300 that has selected the sub mode), and in the sub mode, the second processing unit 316 sequentially executes the second processes in accordance with the progress of the second processes (the second programs) by the other controller (e.g., the other controller 300 that has selected the main mode).

[0070] The processing result storage unit 312 stores data generated by the processing unit 313 in the process of executing a plurality of first programs and data generated by the second processing unit 316 in the process of executing a plurality of second programs. The processing result storage unit 312 functions as the above-mentioned processing result storage unit 112 in the main mode, and functions as the above-mentioned processing result storage unit 212 in the sub mode.

[0071] In the main mode, the status transmission unit 314 functions as the above-mentioned main status transmission unit 114, and in the sub mode, it functions as the above-mentioned sub status transmission unit 221. For example, in the main mode, the status transmission unit 314 sequentially transmits a completion notification for each process to another controller (e.g., another controller 300 that has selected the sub mode) as the progress of a plurality of processes, and in the sub mode, it sequentially transmits a completion notification for each process to another controller (e.g., another controller 300 that has selected the main mode) as the progress of a plurality of processes.

[0072] The diagnosis unit 315 diagnoses the presence or absence of an abnormality in the controller 300 based on the execution result of a predetermined diagnosis process. The diagnosis unit 315 functions as the above-mentioned diagnosis unit 115 in the main mode, and functions as the above-mentioned diagnosis unit 222 in the sub mode.

[0073] In the sub mode, the switching unit 322 functions as the above-mentioned switching unit 214. For example, in the sub mode, when another controller (e.g., another controller 300 selecting the main mode) stops multiple processes due to an abnormality, the switching unit 322 causes the mode selection unit 321 to select the main mode.

[0074] The above-mentioned "settings" that cause the mode selection unit 321 to select the main mode or the sub mode may be stored in a storage unit that can be referenced by both the controller 300 and the other controllers. For example, the settings may be stored in the keep relay 16 provided on the mount base 11. In the sub mode, when the other controller (e.g., the other controller 300 that has selected the main mode) stops multiple processes due to an abnormality, the switching unit 322 changes the settings stored in the keep relay 16 so that the mode selection unit 321 selects the main mode.

[0075] In the other controller 300 that has recovered from the abnormality, the sub mode is selected by the mode selection unit 321 based on the changed setting. As a result, a redundant system is reconstructed by the controller 300 that has switched from the sub mode to the main mode and the controller 300 that has recovered as the sub mode.

[0076] In the sub mode, the comparison unit 317 functions as the above-mentioned comparison unit 217. The notification unit 323 functions as the above-mentioned notification unit 121 in the main mode, and functions as the above-mentioned notification unit 215 in the sub mode.

[0077] Fig. 5 is a block diagram illustrating a hardware configuration of a controller 300 functioning as the CPU module 100 and a controller 300 functioning as the CPU module 200. As shown in Fig. 5, the controller 300 has a circuit 390. The circuit 390 has a processor 391, a memory 392, a storage 393, a timer 394, and a bus interface 395.

[0078] The storage 393 is composed of one or more non-volatile memory devices such as a flash memory or a hard disk. The storage 393 stores a program for causing the controller 300 to select either a main mode or a sub mode based on a predetermined setting, to repeat, in a control period, the control of a control target by sequentially executing a plurality of processes in the main mode regardless of the progress of the plurality of processes by the other controller, to sequentially execute a plurality of processes in the sub mode by following the progress of the plurality of processes by the other controller, and to select the main mode in the sub mode when the other controller stops the plurality of processes due to an abnormality. For example, the storage 393 stores a program for causing the controller 300 to configure the above-mentioned functional blocks.

[0079] The memory 392 is composed of one or more volatile memory devices such as a random access memory. The memory 392 temporarily stores a program loaded from the storage 393. The processor 391 is composed of one or more arithmetic devices such as a CPU or a GPU. The processor 391 executes the program loaded in the memory 392, thereby configuring each of the above-mentioned functional blocks in the controller 300. The calculation results by the processor 391 are temporarily stored in the memory 392.

[0080] The timer 394 measures the elapsed time by, for example, counting system clock pulses, and generates the above-mentioned interrupt signal and second interrupt signal. The bus interface 395 communicates with multiple option modules 14 via the mount base 11 in response to a request from the processor 391. The bus interface 395 also changes the settings stored in the keep relay 16 of the mount base 11 in response to a request from the processor 391. The hardware configuration illustrated above is merely an example, and can be modified as appropriate.

[0081] [Control Procedure] As an example of the control method, a control procedure for the plant 2 executed by the control system 10 is illustrated. This procedure includes repeating in a control period the sequential execution of a plurality of processes in the CPU module 100 to control the plant 2 regardless of the progress of the plurality of processes by the CPU module 200, sequential execution of a plurality of processes in the CPU module 200 in accordance with the progress of the plurality of processes by the CPU module 100, and, when the CPU module 100 stops the plurality of processes due to an abnormality, continuing the execution of the plurality of processes by the CPU module 100 regardless of the progress of the plurality of processes and starting the control of the plant 2.

[0082] Below are illustrated the redundancy control procedure when no abnormality occurs, the switching procedure when an abnormality occurs during output processing, input processing, or arithmetic processing, and the notification procedure when an abnormality occurs in the sub-controller. (Redundancy Control Procedure) As shown in Fig. 6, the CPU module 100 and the CPU module 200 execute steps S101 and S201, respectively. In step S101, the main processing unit 113 acquires an interrupt signal. In step S201, the sub-processing unit 213 acquires the interrupt signal acquired by the main processing unit 113 from the CPU module 100.

[0083] In response to receiving the interrupt signal, the CPU module 100 and the CPU module 200 execute steps S102 and S202, respectively. In step S102, the main processing unit 113 starts output processing for the first option module 14. In step S202, the sub-processing unit 213 starts waiting for the completion of the output processing started in step S102. When the output processing started in step S102 is completed, the CPU module 100 executes step S103. In step S103, the main status transmission unit 114 transmits a completion notification of the output processing started in step S102 to the CPU module 200.

[0084] The CPU module 200 executes step S203 in response to the transmission of the completion notification from the main status transmission unit 114. In step S203, the sub-processing unit 213 completes waiting for the completion of the output process.

[0085] After executing step S103, the CPU module 100 repeats starting the output process and sending a notification of completion of the output process while changing the output value equal to or greater than 1 and the output destination until all output processes are completed. In the figure, an example is shown in which the CPU module 100 executes three processes, namely, steps S104 and S105, steps S106 and S107, and steps S108 and S109, after steps S102 and S103.

[0086] In step S104, the main processing unit 113 starts output processing for the second option module 14. In step S105, the main status transmission unit 114 transmits a completion notification of the output processing started in step S104 to the CPU module 200. In step S106, the main processing unit 113 starts output processing for the third option module 14. In step S107, the main status transmission unit 114 transmits a completion notification of the output processing started in step S106 to the CPU module 200. In step S108, the main processing unit 113 starts output processing for the last option module 14. In step S109, the main status transmission unit 114 transmits a completion notification of the output processing started in step S108 to the CPU module 200.

[0087] Corresponding to the CPU module 100 repeating the output process, the CPU module 200 repeatedly waits for the completion of the output process by the main processing unit 113. In the figure, after steps S202 and S203, the CPU module 200 executes three processes, namely steps S204 and S205, steps S206 and S207, and steps S208 and S209.

[0088] In step S204, the sub-processing unit 213 starts waiting for the completion of the output process started in step S104. In step S205, the sub-processing unit 213 completes waiting for the completion of the output process. In step S206, the sub-processing unit 213 starts waiting for the completion of the output process started in step S106. In step S207, the sub-processing unit 213 completes waiting for the completion of the output process. In step S208, the sub-processing unit 213 starts waiting for the completion of the output process started in step S108. In step S209, the sub-processing unit 213 completes waiting for the completion of the output process.

[0089] 7, the CPU module 100 executes step S111 after step S109. In step S111, the main processing unit 113 starts input processing from the first option module 14. The CPU module 200 executes step S211 after step S209. In step S211, the sub-processing unit 213 starts waiting for the completion of the input processing started in step S111. Since step S209 is executed after the completion notification from the main status transmission unit 114, step S211 is also executed after the completion notification from the main status transmission unit 114.

[0090] When the output process started in step S111 is completed, the CPU module 100 executes step S112. In step S112, the main status transmission unit 114 transmits to the CPU module 200 a completion notification of the output process started in step S111.

[0091] The CPU module 200 executes step S212 in response to transmission of the completion notification from the main status transmission unit 114. In step S212, the sub-processing unit 213 completes waiting for the completion of the input process, and acquires one or more input values ​​included in the completion notification.

[0092] After executing step S112, the CPU module 100 repeats starting the input process and sending a notification of completion of the input process while changing the input source until all input processes are completed. In the figure, a case is illustrated in which the CPU module 100 executes three processes, namely, steps S113 and S114, steps S115 and S116, and steps S117 and S118, after steps S111 and S112.

[0093] In step S113, the main processing unit 113 starts input processing from the second option module 14. In step S114, the main status transmission unit 114 transmits a completion notification of the input processing started in step S113 to the CPU module 200. In step S115, the main processing unit 113 starts input processing from the third option module 14. In step S116, the main status transmission unit 114 transmits a completion notification of the input processing started in step S115 to the CPU module 200. In step S117, the main processing unit 113 starts input processing from the last option module 14. In step S118, the main status transmission unit 114 transmits a completion notification of the input processing started in step S117 to the CPU module 200.

[0094] Corresponding to the CPU module 100 repeating the input process, the CPU module 200 repeatedly waits for the completion of the input process by the sub-processing unit 213. In the figure, after steps S211 and S212, the CPU module 200 executes three processes, namely steps S213 and S214, steps S215 and S216, and steps S217 and S218.

[0095] In step S213, the sub-processing unit 213 starts waiting for the completion of the input process started in step S113. In step S214, the sub-processing unit 213 completes the wait for the completion of the input process, and acquires one or more input values ​​included in the completion notification. In step S215, the sub-processing unit 213 starts waiting for the completion of the input process started in step S115. In step S216, the sub-processing unit 213 completes the wait for the completion of the input process, and acquires one or more input values ​​included in the completion notification. In step S217, the sub-processing unit 213 starts waiting for the completion of the input process started in step S117. In step S218, the sub-processing unit 213 completes the wait for the completion of the input process, and acquires one or more input values ​​included in the completion notification.

[0096] 8, the CPU module 100 executes step S121 after step S118. In step S121, the main processing unit 113 starts the first arithmetic processing. The CPU module 200 executes step S221 after step S218. In step S221, the sub-processing unit 213 starts the first arithmetic processing. Since step S218 is executed after the completion notification from the main status transmission unit 114, step S221 is also executed after the completion notification from the main status transmission unit 114.

[0097] When the arithmetic processing started in step S121 is completed, the CPU module 100 executes step S122. In step S122, the main status transmission unit 114 transmits to the CPU module 200 a completion notification of the arithmetic processing started in step S121.

[0098] After executing step S122, the CPU module 100 repeats starting the arithmetic processing and sending a notification of completion of the arithmetic processing until all the arithmetic processing is completed. In the figure, after steps S121 and S122, the CPU module 100 executes three processes, namely steps S123 and S124, steps S125 and S126, and steps S127 and S128.

[0099] In step S123, the main processing unit 113 starts the second arithmetic process. In step S124, the main status transmission unit 114 transmits a completion notification of the arithmetic process started in step S123 to the CPU module 200. In step S125, the main processing unit 113 starts the third arithmetic process. In step S126, the main status transmission unit 114 transmits a completion notification of the arithmetic process started in step S125 to the CPU module 200. In step S127, the main processing unit 113 starts the final arithmetic process. In step S128, the main status transmission unit 114 transmits a completion notification of the arithmetic process started in step S127 to the CPU module 200.

[0100] The CPU module 200 executes the next arithmetic processing every time it completes its own arithmetic processing and receives a completion notification of the arithmetic processing by the main processing unit 113 until all arithmetic processing is completed. For example, after the CPU module 200 completes the arithmetic processing started in step S221 and receives the completion notification transmitted in step S122, it executes step S222. In step S222, the sub-processing unit 213 starts the second arithmetic processing. After the arithmetic processing started in step S222 is completed and the completion notification transmitted in step S124 is received, the CPU module 200 executes step S223. In step S223, the sub-processing unit 213 starts the third arithmetic processing. After the arithmetic processing started in step S223 is completed and the completion notification transmitted in step S126 is received, the CPU module 200 executes step S224. In step S224, the sub-processing unit 213 starts the last arithmetic processing.

[0101] After executing step S128, the CPU module 100 executes step S129. In step S129, the main processing unit 113 starts waiting for an interrupt signal in the next cycle. After the arithmetic processing started in step S224 is completed and the completion notification sent in step S128 is received, the CPU module 200 executes step S225. In step S225, the sub-processing unit 213 starts waiting for an interrupt signal in the next cycle. The CPU module 100 and the CPU module 200 repeat the above processes.

[0102] (Switching procedure during output processing) Fig. 9 is a flow chart illustrating a switching procedure when the CPU module 100 stops multiple output processes due to an abnormality. In the example of Fig. 9, the CPU module 100 stops multiple processes due to an abnormality that occurs after the main processing unit 113 starts output processing for the second option module 14 in step S104 and before the output processing is completed. In this case, the CPU module 200 executes step S21 after the sub-processing unit 213 starts waiting for the completion of the output processing by the main status transmission unit 114 in step S204.

[0103] In step S21, the switching unit 214 detects that the main processing unit 113 has stopped multiple processes due to an abnormality (hereinafter simply referred to as an "abnormality"). For example, the switching unit 214 detects the abnormality when the length of the standby time after the start of step S204 exceeds a predetermined threshold. When an abnormality is diagnosed by the diagnosing unit 115 and the main status transmitting unit 114 transmits an abnormality notification, the switching unit 214 may detect the abnormality based on the abnormality notification. The notification unit 215 may notify the operator of the abnormality of the CPU module 100 by displaying on the HMI 31 via at least one option module 14, or the like.

[0104] The switching unit 214 switches the execution content of the sub-processing unit 213 in the output processing from waiting for the completion of the output processing by the main processing unit 113 to outputting one or more output values ​​to the plant 2, switches the source from which the sub-processing unit 213 obtains one or more input values ​​from the CPU module 100 to the plant 2, and causes the sub-processing unit 213 to continue multiple processes from the start of the interrupted output processing.

[0105] Furthermore, the switching unit 214 causes the sub-status transmission unit 221 to start transmitting a completion notification after each process by the sub-processing unit 213. As a result, the processes subsequent to step S104 that were stopped by the CPU module 100 are executed sequentially by the CPU module 200 regardless of the progress of the multiple processes by the CPU module 100.

[0106] (Switching procedure during input processing) Fig. 10 is a flowchart illustrating a switching procedure when the CPU module 100 stops multiple input processes due to an abnormality. In the example of Fig. 10, the CPU module 100 stops multiple processes due to an abnormality that occurs after the main processing unit 113 starts input processing from the second option module 14 in step S113 and before the input processing is completed. In this case, the CPU module 200 executes step S22 after the sub-processing unit 213 starts waiting for the completion of the input processing by the main status transmission unit 114 in step S213.

[0107] In step S22, the switching unit 214 detects an abnormality. For example, the switching unit 214 detects an abnormality when the length of the waiting time after the start of step S213 exceeds a predetermined threshold. When an abnormality is diagnosed by the diagnosing unit 115 and the main status transmitting unit 114 transmits an abnormality notification, the switching unit 214 may detect the abnormality based on the abnormality notification. The notification unit 215 may notify the operator of the abnormality of the CPU module 100 by displaying on the HMI 31 via at least one option module 14, or the like.

[0108] The switching unit 214 switches the execution content of the sub-processing unit 213 in the output processing from waiting for the completion of the output processing by the main processing unit 113 to outputting one or more output values ​​to the plant 2, switches the source from which the sub-processing unit 213 obtains one or more input values ​​from the CPU module 100 to the plant 2, and causes the sub-processing unit 213 to continue multiple processes from the start of the interrupted input processing.

[0109] Furthermore, the switching unit 214 causes the sub-status transmission unit 221 to start transmitting a completion notification after each process by the sub-processing unit 213. As a result, the processes subsequent to step S113 that were stopped by the CPU module 100 are executed sequentially by the CPU module 200 regardless of the progress of the multiple processes by the CPU module 100.

[0110] (Switching procedure during calculation processing) Fig. 11 is a flow chart illustrating a switching procedure when the CPU module 100 stops multiple arithmetic processes due to an abnormality. In the example of Fig. 11, the CPU module 100 stops multiple processes due to an abnormality that occurs after the main processing unit 113 starts the second arithmetic process in step S123 and before the arithmetic process is completed. In this case, the CPU module 200 executes step S23 after the arithmetic process started in step S223 is completed.

[0111] In step S23, the switching unit 214 detects an abnormality. For example, the switching unit 214 detects an abnormality when the length of the waiting time after the arithmetic processing started in step S223 is completed exceeds a predetermined threshold. When an abnormality is diagnosed by the diagnosing unit 115 and the main status transmitting unit 114 transmits an abnormality notification, the switching unit 214 may detect the abnormality based on the abnormality notification. The notifying unit 215 may notify the operator of the abnormality of the CPU module 100 by displaying on the HMI 31 via at least one optional module 14, or the like.

[0112] The switching unit 214 switches the execution content of the sub-processing unit 213 in the output processing from waiting for completion of the output processing by the main processing unit 113 to outputting one or more output values ​​to the plant 2, switches the source from which the sub-processing unit 213 obtains one or more input values ​​from the CPU module 100 to the plant 2, and causes the sub-processing unit 213 to continue multiple processes from the next calculation process.

[0113] The switching unit 214 also causes the sub-status transmission unit 221 to start transmitting a completion notification after each process by the sub-processing unit 213. As a result, the processes following step S123 that the CPU module 100 has stopped are executed sequentially by the CPU module 200 regardless of the progress of the multiple processes by the CPU module 100.

[0114] (Sub-controller abnormality notification procedure) Fig. 12 is a flowchart illustrating an example of an abnormality notification procedure when the CPU module 200 stops multiple arithmetic processing due to an abnormality. In the example of Fig. 12, the CPU module 200 stops multiple processes due to an abnormality that occurs after the sub-processing unit 213 starts the second arithmetic processing in step S222 and before the arithmetic processing is completed. In this case, the CPU module 100 executes step S11 after completing the arithmetic processing started in step S123.

[0115] In step S11, the notification unit 121 detects that the sub-processing unit 213 has stopped multiple processes due to an abnormality (hereinafter simply referred to as an "abnormality"). For example, the notification unit 121 detects the abnormality when the length of the waiting time for the completion notification from the sub-status transmission unit 221 exceeds a predetermined threshold after the arithmetic processing started in step S123 is completed. When an abnormality is diagnosed by the diagnosis unit 222 and the sub-status transmission unit 221 transmits an abnormality notification, the notification unit 121 may detect the abnormality based on the abnormality notification.

[0116] The notification unit 121 does not necessarily have to check for an abnormality every time a calculation process is completed. For example, the notification unit 121 may check for an abnormality only after the final calculation process in one cycle is completed.

[0117] The notification unit 121 notifies an operator of an abnormality in the CPU module 200 by, for example, displaying on the HMI 31 via at least one option module 14. Thereafter, the CPU module 100 continues the multiple processes regardless of the progress of the multiple processes by the CPU module 200.

[0118] Further examples of a redundancy processing procedure for a plurality of second processes, an interruption procedure for a plurality of first processes to a plurality of second processes, and a switching procedure when an abnormality occurs during a second process will be described below.

[0119] (Redundancy processing procedure for the second process) 13, the CPU module 100 and the CPU module 200 execute steps S131 and S231, respectively. In step S131, the second main processing unit 116 acquires a second interrupt signal. In step S231, the second sub-processing unit 216 acquires the second interrupt signal acquired by the second main processing unit 116 from the CPU module 100.

[0120] In response to receiving the second interrupt signal, the CPU module 100 and the CPU module 200 execute steps S132 and S232, respectively. In step S132, the second main processing unit 116 starts the first second processing. In step S232, the second sub-processing unit 216 starts the first second processing.

[0121] When the first second process started in step S132 is completed, the CPU module 100 executes step S133. In step S133, the main status transmission unit 114 transmits to the CPU module 200 a completion notification of the first arithmetic process started in step S132.

[0122] After executing step S133, the CPU module 100 repeats starting the second process and sending a notification of completion of the second process until all of the second processes are completed. In the figure, a case is illustrated in which the CPU module 100 executes three second processes, namely, steps S134 and S135, steps S136 and S137, and steps S138 and S139, after steps S132 and S133.

[0123] In step S134, the second main processing unit 116 starts the second second process. In step S135, the main status transmission unit 114 transmits a completion notification of the second second process started in step S134 to the CPU module 200. In step S136, the second main processing unit 116 starts the third second process. In step S137, the main status transmission unit 114 transmits a completion notification of the third second process started in step S136 to the CPU module 200. In step S138, the second main processing unit 116 starts the last second process. In step S139, the main status transmission unit 114 transmits a completion notification of the last second process started in step S138 to the CPU module 200.

[0124] The CPU module 200 executes the next second process each time it completes its own second process and receives a completion notification of the second process by the second main processing unit 116 until all second processes are completed. For example, the CPU module 200 executes step S233 after completing the first second process started in step S232 and receiving the completion notification transmitted in step S133. In step S233, the second sub-processing unit 216 starts the second second process. After completing the second second process started in step S233 and receiving the completion notification transmitted in step S135, the CPU module 200 executes step S234. In step S234, the second sub-processing unit 216 starts the third second process. After completing the third second process started in step S234 and receiving the completion notification transmitted in step S137, the CPU module 200 executes step S235. In step S235, the second sub-processing unit 216 starts the final second process.

[0125] After executing step S139, the CPU module 100 executes step S141. In step S141, the second main processing unit 116 starts waiting for the second interrupt signal in the next cycle. After the arithmetic processing started in step S235 is completed and the completion notification sent in step S139 is received, the CPU module 200 executes step S236. In step S236, the second sub-processing unit 216 starts waiting for the second interrupt signal in the next cycle. The CPU module 100 and the CPU module 200 repeat the above processes.

[0126] (Interrupt procedure of the first process during the second process) Fig. 14 is a flowchart illustrating a case where the redundancy processing procedure of the first process is executed due to the occurrence of a first interrupt signal during the redundancy processing procedure of the second process. Fig. 14 illustrates a case where the second main processing unit 116 starts the second second process in step S134, and the first interrupt signal occurs after the second sub-processing unit 216 starts the second second process in step S234.

[0127] When the first interrupt signal occurs, the second main processing unit 116 suspends the second second process started in step S134, and the main processing unit 113 executes the above-mentioned step S101 (acquisition of the first interrupt signal). The second sub-processing unit 216 suspends the second second process started in step S234, and the sub-processing unit 213 executes the above-mentioned step S201 (acquisition of the first interrupt signal).

[0128] In response to acquiring the first interrupt signal, the main processing unit 113 and the main status transmission unit 114 execute steps S102 to S109 (multiple output processes) and steps S111 to S118 (multiple input processes). The sub-processing unit 213 executes steps S202 to S209 (multiple output processes) and steps S211 to S218 (multiple input processes). After executing step S118, the main processing unit 113 suspends the multiple first processes, and after executing step S218, the sub-processing unit 213 suspends the multiple first processes.

[0129] After suspending the multiple first processes, the CPU module 100 executes step S151, and the CPU module 200 executes step S251. In step S151, the second main processing unit 116 completes the second suspended second process. In step S251, the second sub-processing unit 216 completes the second suspended second process.

[0130] Next, the CPU module 200 executes step S252. In step S252, the comparison unit 217 checks whether or not there is a difference between the interrupted second process completed by the second main processing unit 116 and the interrupted second process completed by the second sub-processing unit 216 based on the progress of the multiple second processes by the second main processing unit 116. As described above, if the CPU module 100 and the CPU module 200 are interrupting the same second second process, the determination result in step S252 is "no difference". If the CPU module 100 is interrupting the third second process and the CPU module 200 is interrupting the second second process, the determination result in step S252 is "there is a difference". If the determination result in step S252 is "there is a difference", the CPU module 200 executes step S253. In step S253, the second sub-processing unit 216 completes up to the next second process (for example, the third second process).

[0131] After completing the interrupted second process, the second main processing unit 116 causes the main processing unit 113 to resume the first process. The main processing unit 113 executes steps S121 to S129 (plurality of arithmetic processes). After completing the interrupted second process, the second sub-processing unit 216 causes the sub-processing unit 213 to resume the first process. The sub-processing unit 213 executes steps S221 to S225 (plurality of arithmetic processes).

[0132] After the main processing unit 113 completes the multiple arithmetic processes, the second main processing unit 116 resumes the multiple second processes from step S136. After the sub-processing unit 213 completes the multiple arithmetic processes, the second sub-processing unit 216 resumes the multiple second processes from step S233.

[0133] (Switching procedure during the second process) Fig. 15 is a flowchart illustrating a switching procedure when the CPU module 100 stops multiple second processes due to an abnormality. In the example of Fig. 15, the CPU module 100 stops multiple second processes due to an abnormality that occurs after the second main processing unit 116 starts a second second process in step S134 and before the second second process is completed. In this case, the CPU module 200 executes step S24 after the second second process started in step S234 is completed.

[0134] In step S24, the switching unit 214 detects an abnormality. For example, the switching unit 214 detects an abnormality when the length of the waiting time after the second second process started in step S234 is completed exceeds a predetermined threshold. When an abnormality is diagnosed by the diagnosing unit 115 and the main status transmitting unit 114 transmits an abnormality notification, the switching unit 214 may detect the abnormality based on the abnormality notification. The notifying unit 215 may notify the operator of the abnormality of the CPU module 100 by displaying on the HMI 31 via at least one optional module 14, or the like.

[0135] The switching unit 214 causes the second sub-processing unit 216 to continue the multiple processes, starting from the next second process. The switching unit 214 also causes the sub-status transmission unit 221 to start transmitting a completion notification after each process by the second sub-processing unit 216. As a result, the processes following step S134, which was stopped by the CPU module 100, are executed sequentially by the CPU module 200 regardless of the progress of the multiple second processes by the CPU module 100.

[0136] The above disclosure includes the following configurations. 〔summary〕 (1) A control system 10 comprising a main controller 100 for controlling a control object 2, and a sub-controller 200 for controlling the control object 2 in place of the main controller 100 when an abnormality occurs in the main controller 100, wherein the main controller 100 has a main processing unit 113 for sequentially executing a plurality of processes to control the control object 2 in a control period regardless of the progress of the plurality of processes by the sub-controller 200, and the sub-controller 200 has a sub-processing unit 213 for sequentially executing a plurality of processes in accordance with the progress of the plurality of processes by the main processing unit 113, and a switching unit 214 for causing the sub-processing unit 213 to continue executing the plurality of processes regardless of the progress of the plurality of processes by the main processing unit 113 when the main processing unit 113 stops the plurality of processes due to an abnormality, and causing the sub-processing unit 213 to start control of the control object 2. According to this control system 10, the sub-processing unit 213 executes a plurality of processes in sequence following the progress of the plurality of processes executed by the main processing unit 113, and when the main processing unit 113 stops the plurality of processes due to an abnormality, the sub-processing unit 213 continues the execution of the plurality of processes regardless of the progress of the plurality of processes executed by the main processing unit 113. Since the main controller 100 does not adjust its own progress according to the progress of the sub-controller 200, the load on the main controller 100 and the sub-controller 200 is reduced. Since the sub-controller 200 executes a plurality of processes in sequence following the progress of the processes executed by the main controller 100, the switching time after the main controller 100 stops the process remains at the execution delay time of the sub-controller 200 immediately before the main controller 100 stops the process. Since the execution delay time returns to zero every control cycle, the execution delay time is maintained to be minute. Therefore, the switching from the main controller 100 to the sub-controller 200 is performed quickly in a short time less than the minute execution delay time. Therefore, the control system 10 is effective in achieving both rapid switching from the main controller 100 to the sub-controller 200 and a reduction in the processing load on the main controller 100 and the sub-controller 200.

[0137] (2) The main controller 100 further has a main status transmission unit 114 which sequentially transmits a completion notification for each process to the sub-controller 200 as the progress of the multiple processes, and the sub-processing unit 213 executes the next process after receiving a completion notification of one process, thereby sequentially executing the multiple processes in accordance with the progress of the multiple processes by the main processing unit 113, in the control system 10 described in (1). By waiting for a completion notification for each process, the progress of a plurality of processes by the sub-processing unit 213 is more reliably maintained in a state following the progress of a plurality of processes by the main processing unit 113. This makes it possible to prevent, for example, a situation in which a process to be performed on the control target 2 after switching is omitted due to the sub-processing unit 213 performing the process first.

[0138] (3) The control system 10 according to (2), wherein the switching unit 214 detects that the main processing unit 113 has stopped multiple processes due to an abnormality based on a delay in receiving a completion notification. Switching from the main controller 100 to the secondary controller 200 can be achieved in a timely manner based on the delay in receiving the completion notification transmitted for each process.

[0139] (4) The control system 10 described in (3) above, wherein the switching unit 214 detects that the main processing unit 113 has stopped multiple processes due to an abnormality when the length of time that the sub-processing unit 213 waits for notification of the completion of one process exceeds a predetermined threshold. Anomalies in the main controller 100 can be detected with greater reliability.

[0140] (5) The main controller 100 further has a diagnostic unit 115 that diagnoses whether or not there is an abnormality based on the results of executing a predetermined diagnostic process, and the main status transmission unit 114 transmits an abnormality notification to the sub-controller 200 when the diagnostic unit 115 diagnoses that there is an abnormality, and the switching unit 214 detects that the main processing unit 113 has stopped multiple processes due to an abnormality based on the abnormality notification from the main status transmission unit 114, in a control system 10 described in (3) or (4). Notification from the primary controller 100 can be used to more quickly switch from the primary controller 100 to the secondary controller 200 .

[0141] (6) The multiple processes include an input process for acquiring one or more input values, the main processing unit 113 acquires one or more input values ​​from the control object 2 in the input process, the sub-processing unit 213 acquires one or more input values ​​acquired by the main processing unit 113 from the main controller 100 in the input process, and the switching unit 214 switches the acquisition source of the one or more input values ​​by the sub-processing unit 213 from the main controller 100 to the control object 2 when the main processing unit 113 stops the multiple processes due to an abnormality. It is possible to reduce the communication load between the control system 10 and the controlled object 2 and the like while making the control system 10 redundant.

[0142] (7) The control system 10 according to (6), wherein, when the process stopped by the main processing unit 113 is an input process, the switching unit 214 causes the sub-processing unit 213 to continue the multiple processes from the start of the stopped input process. It is possible to quickly switch from the main controller 100 to the sub-controller 200 without interrupting input processing.

[0143] (8) A control system 10 described in any one of (1) to (7), wherein the plurality of processes includes an output process for outputting one or more output values, the main processing unit 113 outputs the one or more output values ​​to the control object 2 in the output process, the sub-processing unit 213 executes a next process in response to completion of the output process by the main processing unit 113 without outputting the one or more output values ​​to the control object 2 in the output process, and the switching unit 214 causes the sub-processing unit 213 to output the one or more output values ​​to the control object 2 in the output process when the main processing unit 113 aborts the plurality of processes due to an abnormality. The communication load between the control system 10 and the controlled object 2 can be reduced.

[0144] (9) The control system 10 according to (8), wherein, when the process stopped by the main processing unit 113 is an output process, the switching unit 214 causes the sub-processing unit 213 to continue the multiple processes from the start of the stopped output process. It is possible to quickly switch from the main controller 100 to the sub-controller 200 without interrupting the output process.

[0145] (10) A control system 10 described in any one of (1) to (9), wherein the plurality of processes includes a calculation process that does not include input / output to the control target 2, and when the process stopped by the main processing unit 113 is a calculation process, the switching unit 214 causes the sub-processing unit 213 to continue the plurality of processes without returning to the start of the stopped calculation process. The communication load between the control system 10 and the controlled object 2 can be reduced.

[0146] (11) The multiple processes include, in order, one or more output processes for outputting one or more output values ​​to the control target 2, one or more input processes for acquiring one or more input values ​​from the control target 2, and one or more arithmetic processes for calculating one or more output values ​​in the next control cycle based on the one or more input values, and the main controller 100 further has a second main processing unit 116 that sequentially executes multiple second processes separate from the multiple processes over multiple periods in which the main control unit does not execute the multiple processes, and the sub-controller 200 further has a second sub-processing unit 216 that sequentially executes the multiple second processes in accordance with the progress of the multiple second processes by the second main processing unit 116 over multiple periods in which the sub-processing unit 213 does not execute the multiple processes, and each of the main processing unit 113 and the sub-processing unit 213 is The control system 10 described in any one of (1) to (10), wherein the multiple processes are suspended after the execution of the above output processes and one or more input processes, the second main processing unit 116 suspends the second process while at least the main processing unit 113 is executing one or more output processes and one or more input processes, and after the main processing unit 113 completes the one or more output processes and the one or more input processes, causes the main processing unit 113 to resume the multiple processes after completing the suspended second process, and the second sub-processing unit 216 suspends the second process while at least the sub-processing unit 213 is executing one or more output processes and one or more input processes, and after the sub-processing unit 213 completes the one or more output processes and the one or more input processes, causes the sub-processing unit 213 to resume the multiple processes after completing the suspended second process. The main processing unit 113 and the sub-processing unit 213 each suspend multiple processes after executing input / output processing, and after aligning the progress of the processes of the second main processing unit 116 and the second sub-processing unit 216, the main processing unit 113 and the sub-processing unit 213 resume multiple processes. This prevents the difference in the progress of the processes of the second main processing unit 116 and the second sub-processing unit 216 from affecting the processes of the main processing unit 113 and the sub-processing unit 213 while maintaining the fixed periodicity of the input / output processing. By completing the second process that is suspended, the progress of the processes of the second main processing unit 116 and the second sub-processing unit 216 can be easily aligned. This makes it possible to improve the reliability of control while suppressing the processing load in the control system 10.

[0147] (12) The control system 10 according to (11), wherein in at least one of a plurality of cycles repeated in a control period, the plurality of processes includes a process based on a result of at least one of a plurality of second processes. Since the progress of multiple second processes affects multiple processes, reliability is further improved by aligning the progress by the second main processing unit 116 and the second sub-processing unit 216 and then resuming multiple processes by the main processing unit 113 and the sub-processing unit 213.

[0148] (13) The sub-controller 200 further has a comparison unit 217 that compares the interrupted second process in the second main processing unit 116 with the interrupted second process in the second sub-processing unit 216 based on the progress of multiple second processes by the second main processing unit 116, and when the interrupted second process in the second main processing unit 116 is a second process that follows or is subsequent to the interrupted second process in the second sub-processing unit 216, the second sub-processing unit 216 causes the sub-processing unit 213 to resume the multiple processes after completing one or more output processes and one or more input processes by the sub-processing unit 213 and then completing the interrupted second process in the second main processing unit 116. A control system 10 described in (11) or (12). Even if the second process interrupted by the second main processing unit 116 is different from the second process interrupted by the second sub-processing unit 216, the progress of the multiple second processes by the second main processing unit 116 can be utilized to easily align the progress by the second main processing unit 116 and the second sub-processing unit 216.

[0149] (14) The sub-controller 200 further has a sub-status transmission unit 221 which sequentially transmits a completion notification for each process to the main controller 100 as the progress of the multiple processes, and the main controller 100 further has an alarm unit 121 which notifies that the sub-processing unit 213 has stopped the multiple processes due to an abnormality based on a delay in receiving the completion notification, in a control system 10 described in any one of (1) to (13). By notifying the main controller 100 of an abnormality in the sub-controller 200, it is possible to facilitate rapid recovery of the redundant system while continuing control by the main controller 100.

[0150] (15) A plant system 1 including the control system 10 according to any one of (1) to (14) and a plant 2 controlled by the control system 10 as a controlled object 2.

[0151] (16) A controller which constitutes a redundant control system 10 together with other controllers, the controller comprising: a mode selection unit which selects either a main mode or a sub mode based on a predetermined setting; a processing unit which, in the main mode, repeats in a control period the sequential execution of multiple processes to control a control target 2 regardless of the progress of the multiple processes by the other controllers, and, in the sub mode, sequentially executes the multiple processes in accordance with the progress of the multiple processes by the other controllers; and a switching unit 214 which, in the sub mode, causes the mode selection unit to select the main mode when the other controller stops the multiple processes due to an abnormality.

[0152] (17) A controller as described in (16), in which the settings are stored in a memory unit that can be referenced by both the other controller and the controller, and the switching unit 214 changes the settings stored in the memory unit so that the main mode is selected by the mode selection unit when the other controller stops multiple processes due to an abnormality in the secondary mode. By changing the settings stored in the memory unit, the other controller can be restored in the secondary mode. Operation in the primary mode is performed regardless of the progress of multiple processes by the other controllers, so even if the other controllers return, the progress of multiple processes by the controller is not affected. This makes it possible to further improve the continuity of control by the redundant system.

[0153] (18) A control method including: in a main controller 100 constituting a redundant system together with a sub-controller 200, repeating in a control period the sequential execution of multiple processes to control a control object 2 regardless of progress of the multiple processes by the sub-controller 200; in the sub-controller 200, sequential execution of multiple processes in accordance with the progress of the multiple processes by the main controller 100; and, when the main controller 100 stops the multiple processes due to an abnormality, continuing the execution of the multiple processes regardless of progress of the multiple processes by the main controller 100 and starting control of the control object 2. [Explanation of symbols]

[0154] 1...plant system, 2...plant, 10...control system, 100...main controller, 200...sub-controller, 2...controlled object, 113...main processing unit, 114...main status transmission unit, 115...diagnosis unit, 213...sub-processing unit, 214...switching unit, 116...second main processing unit, 216...second sub-processing unit, 217...comparison unit, 221...sub-status transmission unit, 121...alarm unit.

Claims

1. A main controller that controls a control target; a sub-controller that controls the control target in place of the main controller when an abnormality occurs in the main controller; Equipped with the main controller has a main processing unit that repeats, in a control period, sequentially executing the plurality of processes to control the control target, regardless of progress of the plurality of processes by the sub-controllers; The sub-controller is a sub-processing unit that sequentially executes the plurality of processes in accordance with the progress of the plurality of processes executed by the main processing unit; a switching unit that, when the main processing unit stops the plurality of processes due to the abnormality, causes the sub-processing unit to continue the execution of the plurality of processes regardless of progress of the plurality of processes by the main processing unit, and starts control of the control target by the sub-processing unit; having Control system.

2. The main controller further includes a main status transmission unit that sequentially transmits a completion notification for each of the plurality of processes to the sub-controllers as a progress of the processes, the sub-processing unit executes a next process after receiving the completion notification of one process, thereby sequentially executing the plurality of processes in accordance with the progress of the plurality of processes executed by the main processing unit. The control system of claim 1 .

3. The switching unit detects that the main processing unit has stopped the plurality of processes due to the abnormality based on a delay in receiving the completion notification. The control system of claim 2.

4. the switching unit detects that the main processing unit has stopped the plurality of processes due to the abnormality when a length of time during which the sub-processing unit has been waiting for the completion notification of one process exceeds a predetermined threshold. The control system of claim 3.

5. The main controller further includes a diagnostic unit that diagnoses the presence or absence of an abnormality based on a result of execution of a predetermined diagnostic process, the main status transmission unit transmits an abnormality notification to the sub-controller when the diagnosis unit diagnoses that there is an abnormality; the switching unit detects that the main processing unit has stopped the plurality of processes due to the abnormality, further based on the abnormality notification from the main status transmission unit.

5. A control system according to claim 3 or 4.

6. The plurality of processes includes an input process for acquiring one or more input values; The main processing unit acquires the one or more input values ​​from the control object in the input processing, The sub-processing unit acquires, in the input process, the one or more input values ​​acquired by the main processing unit from the main controller; the switching unit switches an acquisition source of the one or more input values ​​by the sub-processing unit from the main controller to the control object when the main processing unit stops the plurality of processes due to the abnormality. A control system according to any one of claims 1 to 4.

7. when the process stopped by the main processing unit is the input process, the switching unit causes the sub-processing unit to continue the plurality of processes from the start of the stopped input process. The control system of claim 6.

8. the plurality of processes includes an output process for outputting the one or more output values; The main processing unit outputs the one or more output values ​​to the control object in the output process, the sub-processing unit, in the output process, executes a next process in response to completion of the output process by the main processing unit without outputting the one or more output values ​​to the control target; the switching unit causes the sub-processing unit to output the one or more output values ​​to the control target in the output process when the main processing unit stops the plurality of processes due to the abnormality. A control system according to any one of claims 1 to 4.

9. When the process stopped by the main processing unit is the output process, the switching unit causes the sub-processing unit to continue the plurality of processes from the start of the stopped output process. The control system of claim 8.

10. the plurality of processes includes a calculation process that does not include an input / output to the control target, When the process stopped by the main processing unit is the arithmetic process, the switching unit causes the sub-processing unit to continue the plurality of processes without returning to the start of the stopped arithmetic process. A control system according to any one of claims 1 to 4.

11. the plurality of processes include, in order, one or more output processes for outputting one or more output values ​​to the control object, one or more input processes for acquiring one or more input values ​​from the control object, and one or more calculation processes for calculating the one or more output values ​​in a next control cycle based on the one or more input values; the main controller further includes a second main processing unit that sequentially executes a plurality of second processes different from the plurality of processes over a plurality of periods during which the main control unit does not execute the plurality of processes; The sub-controller further includes a second sub-processing unit that sequentially executes the second processes in accordance with progress of the second processes by the second main processing unit over a plurality of periods during which the sub-processing unit does not execute the plurality of processes, each of the main processing unit and the sub-processing unit interrupts the plurality of processes after executing the one or more output processes and the one or more input processes; the second main processing unit suspends the second process during at least the execution of the one or more output processes and the one or more input processes by the main processing unit, and after the one or more output processes and the one or more input processes are completed by the main processing unit, causes the main processing unit to resume the plurality of processes after completing the suspended second process; the second sub-processing unit suspends the second process during at least the execution of the one or more output processes and the one or more input processes by the sub-processing unit, and after the one or more output processes and the one or more input processes are completed by the sub-processing unit, causes the sub-processing unit to resume the plurality of processes after completing the suspended second process; A control system according to any one of claims 1 to 4.

12. In at least one of a plurality of cycles repeated in a control period, the plurality of processes include a process based on a result of at least one of the plurality of second processes. The control system of claim 11.

13. the sub-controller further includes a comparison unit that compares the interrupted second process in the second main processing unit with the interrupted second process in the second sub-processing unit based on progress of the plurality of second processes by the second main processing unit, When the interrupted second process in the second main processing unit is a second process subsequent to the interrupted second process in the second sub-processing unit, after the sub-processing unit completes the one or more output processes and the one or more input processes, the second sub-processing unit resumes the plurality of processes after completing the interrupted second process in the second main processing unit. The control system of claim 11.

14. the sub-controller further includes a sub-status transmission unit that sequentially transmits a completion notification for each of the plurality of processes to the main controller as a progress of the processes, The main controller further includes a notification unit that notifies the sub-processing unit that the sub-processing unit has stopped the plurality of processes due to the abnormality based on a delay in receiving the completion notification. A control system according to any one of claims 1 to 4.

15. The control system according to any one of claims 1 to 3; a plant that is controlled by the control system as the controlled object; A plant system comprising:

16. A controller that configures a redundant control system together with other controllers, a mode selection unit that selects either a main mode or a sub mode based on a predetermined setting; in the main mode, the plurality of processes are sequentially executed to control the control target in a control cycle, regardless of progress of the plurality of processes executed by the other controllers; In the sub mode, the plurality of processes are sequentially executed in accordance with the progress of the plurality of processes executed by the other controller. A processing section; a switching unit that causes the mode selection unit to select the main mode when the other controller stops the plurality of processes due to an abnormality in the sub mode; Equipped with controller.

17. the setting is stored in a storage unit accessible to both the other controller and the controller, the switching unit changes the setting stored in the storage unit so that the main mode is selected by the mode selection unit when the other controller stops the plurality of processes due to an abnormality in the sub mode.

17. The controller of claim 16.

18. In a main controller constituting a redundant system together with the sub-controllers, a control cycle is repeated in which the plurality of processes are sequentially executed to control a control target, regardless of progress of the plurality of processes executed by the sub-controllers; In the sub-controller, sequentially executing the plurality of processes in accordance with the progress of the plurality of processes by the main controller; When the main controller stops the plurality of processes due to an abnormality, the main controller continues the execution of the plurality of processes regardless of the progress of the plurality of processes by the main controller, and starts control of the control target; Including, Control methods.

Images