Mediation control device and mediation control method

Abstract

The present invention provides an arbitration control device that can maintain the availability of a redundant monitoring and control system and perform highly reliable bus arbitration. [Solution] Each bus control module 2A to 2C connected to the bus includes a diagnostic unit 21 that diagnoses the operational health of the bus control modules of its own system and other systems and identifies the bus control module 2 in which a failure has occurred, and a bus arbitration control unit 24 that determines whether the bus right requests are simultaneous for the bus control modules of its own system and other systems that the diagnostic unit 21 has diagnosed as normal, and if it determines that the bus right requests are simultaneous, arbitrates the acquisition of bus right based on a preset priority order.

Description

Technical Field

[0001] The present invention relates to an arbitration control device and an arbitration control method.

Background Art

[0002] Various plants configured as social infrastructure such as chemical plants, water and sewage systems, and power generation plants have their operations monitored and controlled by a monitoring control system. Such monitoring control systems apply device multiplexing and redundancy techniques everywhere, to achieve both high reliability and high availability of plant operations.

[0003] To operate a plant, various monitoring control targets (valves, sensors, etc.) are required. In this specification, for example, valves are treated as process output targets, and sensors are treated as process input targets. In general, a boundary between a multiplexing unit and a common unit always exists on the path from the multiplexed monitoring control system to the monitoring control target. When this boundary is a bus connection part in the control device, it is necessary to perform bus switching for the multiplexed bus masters by bus arbitration control.

[0004] Regarding such a bus arbitration control function, there is a technique disclosed in Patent Document 1. This Patent Document 1 discloses a technology that an arbitration function unit for arbitrating the right to use a common bus between an active control module which is one of redundant control modules and a standby control module which is the other thereof is provided in each of the active control module and the standby control module, and the arbitration function unit in the active control module arbitrates the right to use the common bus.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of Invention

Problems to be Solved by the Invention

[0006] Traditionally, when multiplexed bus masters accessed a common bus, the bus operation was controlled by switching the right to use the common bus through a permission notification sent from another bus master to the bus master that sent the bus usage request. The operational health of the bus masters was checked by monitoring the occurrence of permission notification responses to bus usage requests under timeout conditions. When a timeout was detected, the bus master in question was deemed to have failed and was targeted for disconnection.

[0007] However, in the technology disclosed in Patent Document 1, if the timeout monitoring function itself fails, there is a high possibility that it will misjudge which faulty component should be isolated.

[0008] This invention has been made in view of the above circumstances, and aims to provide bus mediation that enables clear identification of the faulty part and reliable isolation of the faulty part. [Means for solving the problem]

[0009] The arbitration control device according to the present invention arbitrates the granting of bus rights to output signals to the bus by a plurality of bus right request modules connected to a bus. The local bus right request module includes a diagnostic unit that diagnoses the operational health of the local bus right request module and other systems' bus right request modules and identifies a bus right request module that has failed, and a bus arbitration control unit that determines whether the bus right requests of the local bus right request module and other systems' bus right request modules are simultaneous for the local bus right request module and other systems' bus right request modules that the diagnostic unit has diagnosed as normal, and if it is determined that the bus right requests are simultaneous, arbitrates the acquisition of bus rights between the local bus right request module and other systems' bus right request modules based on a priority set in advance. [Effects of the Invention]

[0010] According to the present invention, the availability of a redundant monitoring and control system can be maintained, and reliable bus arbitration can be performed. The above-described mediation control device is one aspect of the present invention, and a mediation control method that reflects one aspect of the present invention is configured in the same manner as the above-described mediation control device. Other issues, configurations, and effects will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0011] [Figure 1] This is a block diagram showing an example of the overall configuration of a monitoring and control system according to one embodiment of the present invention. [Figure 2] This is a block diagram showing an example of the internal configuration of a bus control module according to one embodiment of the present invention. [Figure 3] This is a circuit diagram of each bus control module relating to one embodiment of the present invention. [Figure 4] This is a state transition diagram showing an example of a bus arbitration protocol according to one embodiment of the present invention. [Figure 5] This is a timing chart showing examples of bus mediation in cases of no ties and ties between two parties, according to one embodiment of the present invention. [Figure 6] This is a timing chart showing an example of bus mediation in a three-party tie according to one embodiment of the present invention. [Modes for carrying out the invention]

[0012] Hereinafter, embodiments for carrying out the present invention will be described with reference to the accompanying drawings. In this specification and drawings, components having substantially the same function or configuration are denoted by the same reference numerals, and redundant descriptions are omitted.

[0013] [First Embodiment] Figure 1 is a block diagram showing an example of the overall configuration of a monitoring and control system 100 according to one embodiment of the present invention.

[0014] The monitoring control system 100 includes controllers 1A, 1B, 1C, and bus control modules 2A, 2B, 2C (an example of a bus right request module). When the controllers 1A, 1B, 1C are not distinguished, they are collectively referred to as controller 1. When the bus control modules 2A, 2B, 2C are not distinguished, they are collectively referred to as bus control module 2.

[0015] Further, the bus control modules 2A to 2C are connected to the bus 10. The bus control modules 2A to 2C request a bus right for sending control instructions from the controllers 1A to 1C to the control target 12 via the bus 10. In the monitoring control system 100, the bus arbitration control function according to the present embodiment is implemented by a bus arbitration control unit 23 (see FIG. 2 to be described later) respectively configured in the bus control modules 2A to 2C. For this reason, in the monitoring control system 100, the bus control modules 2A to 2C arbitrate the bus right grant for outputting signals to the bus 10. Since the controllers 1A to 1C and the bus control modules 2A to 2C are multiplexed (tripled) by three devices, they are referred to as a multiplexing unit.

[0016] Each bus control module 2 inputs and outputs signals for performing bus arbitration control with each other. In the figure, the double-headed arrow connecting the bus control modules 2A and 2B, the double-headed arrow connecting the bus control modules 2B and 2C, and the double-headed arrow connecting the bus control modules 2C and 2A are represented as bus right notification signals that indicate a bus right request and bus right possession after the bus right is acquired.

[0017] The reason why the controllers 1A to 1C and the bus control modules 2A to 2C are multiplexed is that high reliability of control over the control target 12 is required. For example, when the controller 1A fails, there is a mode in which control over the control target 12 is continued by the remaining controllers 1B and 1C. As another example, when the control instruction of the failed controller 1A differs from the control instructions of the controllers 1B and 1C, the control instructions of the controllers 1B and 1C are sent to the control target 12 by majority decision, so that there is also a mode for ensuring the reliability of control over the control target 12.

[0018] As a result of arbitration control performed by the bus arbitration control function according to the present embodiment, the bus control modules 2A to 2C access the input / output control modules 11A and 11B connected to the bus 10. When the input / output control modules 11A and 11B are not distinguished, they are collectively referred to as the input / output control module 11. The controlled objects 12 connected to the input / output control modules 11A and 11B are, for example, valves, sensors, and the like. The bus 10, the input / output control modules 11A and 11B, and the controlled objects 12 are objects that are shared and monitored and controlled by the multiplexed controllers 1A to 1C, and thus are called a common unit.

[0019] The controller 1 instructs the input / output control module 11 to capture the state of the controlled object 12. The state of the controlled object 12 is output to the bus 10 via the input / output control module 11, and reaches the controller 1 via the bus control module 2. At this time, as shown in Figure 1, the bus 10 exists as a boundary between the multiplexed unit and the common unit, and the multiplexed bus control modules 2 must not hinder the operation of the bus control modules 2 of other systems via the bus 10.

[0020] As a configuration of the controllers 1, each controller 1 may be given a master-slave relationship such that the controller 1A is an active system (master system) and the controllers 1B and 1C are standby systems (slave systems). In the controllers 1 provided with the master-slave relationship, it is general that only the controller 1A designated as the active system (master system) accesses the input / output control module 11.

[0021] However, each controller 1 has a different purpose, and they may operate in parallel without a master-slave relationship. For example, the multiple controllers 1 configured in the multiplexing unit according to this embodiment operate asynchronously, and the bus control modules 2 connected to each controller 1 are also expected to operate asynchronously. Therefore, when each bus control module 2 belonging to the multiplexing unit uses one bus 10, mediation control is required between the bus control modules 2. Thus, each bus control module 2 has a mediation function as shown in Figure 2, which will be described later, and the bus control modules 2 acquire or relinquish bus rights while mediating with each other. In Figure 1, the parts of each bus control module 2 that have a mediation function are enclosed by a dashed line and are called the bus mediation control function.

[0022] Bus control modules 2A to 2C are equally equipped with bus arbitration functions for each other's bus right requests. In this embodiment, the arbitration principle from bus right request to the completion of bus right acquisition is first-come, first-served. Specifically, in the bus arbitration control function, each bus control module 2, upon confirming the issuance of a bus right notification signal from another bus control module 2, withholds the issuance of its own bus right notification signal, as it will be the later to arrive. Then, after the other bus control module 2 has completed the relinquishment of bus right, the later-arriving bus control module 2 issues a bus right notification signal.

[0023] The bus control modules 2A to 2C, which are configured as a multiplexing unit, are each connected to different controllers 1A to 1C. There are three main cases for the system configuration connecting controllers 1A to 1C and the controlled object 12.

[0024] (Case 1) Controllers 1, each performing a different task, are linked one-to-one to a common input / output control module 11, each for its own purpose. For example, controller 1A is linked to input / output control module 11A, and controller 1B is linked to input / output control module 11B. In this Case 1, controllers 1A and 1B do not share a single input / output control module 11.

[0025] (Case 2) Controller 1, which performs the same task, is configured and controlled upstream. One controller 1 operates as the active system (primary system), while the other two controllers 1 each operate as standby systems (secondary systems). Controllers 1A and 1B share an input / output control module 11, but only the bus control module belonging to the active system (primary system) controller 1 accesses the input / output control module 11.

[0026] (Case 3) As a derivative of Case 2, if the only process input is to capture the state of the controlled object 12, even a standby (slave) controller 1 may access the input / output control module 11 asynchronously in parallel with the active (primary) controller 1.

[0027] Next, we will describe an example of the internal configuration of the bus control module 2A. Figure 2 is a block diagram showing an example of the internal configuration of bus control module 2A. Note that bus control modules 2B and 2C have the same internal configuration as bus control module 2A, so a detailed explanation is omitted. The bus control module 2A includes a diagnostic unit 21, a timer 22, a bus arbitration control unit 23, and a notification unit 24.

[0028] The diagnostic unit 21 has the function of diagnosing the operational health of its own bus control module 2 and the bus control modules 2 of other systems, and identifying the bus control module 2 that has experienced a failure. Here, the diagnostic unit 21 of the own bus control module 2 is characterized by diagnosing its own signals. For example, the diagnostic unit 21 of bus control module 2A has the function of diagnosing the operation of its own bus arbitration control unit 23. Each bus control module 2 then performs loopback diagnosis, duplication matching diagnosis, and survival pulse diagnosis for the signal route used for arbitration. The survival pulse diagnosis is to satisfy the prerequisites for loopback diagnosis. In addition, the survival pulse diagnosis assists in identifying the fault location through, for example, LEDs, status registers, etc. Furthermore, as a function for diagnosing the operation of the bus arbitration control unit 23 of other systems, arbitration timeout monitoring is performed. Only when CONF_TO (arbitration timeout), as shown in Figure 4 later, is it recognized that the other system is abnormal, is the system itself recognized. Even if the system is recognized as abnormal, the system itself does not take any action towards the other system. This is because it assumes that other systems will detect a self-diagnostic abnormality through loopback diagnostics, autonomously stop outputting the bus right notification signal, and withdraw from the series of bus arbitration control operations.

[0029] Timer 22 has the function of counting time using a WAIT timer, etc., as shown in Figure 4, which will be described later. The time counted by Timer 22 is referenced by the bus arbitration control unit 23.

[0030] The bus arbitration control unit 23 determines whether the bus rights requests from its own bus control module 2A and the other systems' bus control modules 2B and 2C, which the diagnostic unit 21 has diagnosed as normal, are simultaneous. If the bus arbitration control unit 23 determines that the bus rights requests are simultaneous, it arbitrates the acquisition of bus rights between its own bus control module YA and the other systems' bus control modules 2B and 2C based on the priority order set in advance. For example, the bus arbitration control unit 23 checks the request status input from the other systems and the request status of its own system for its own bus control module 2A and the other systems' bus control modules 2B and 2C, which the diagnostic unit 21 has diagnosed as normal, and controls the transmission of the bus rights notification signal to ON in the order of priority of the first to arrive, and to OFF in the order of priority if the requests are simultaneous.

[0031] The bus arbitration control unit 23 controls bus arbitration for acquiring or relinquishing bus rights for bus 10 within a predetermined period. The predetermined period is expected to be a short period, such as one bus cycle. If one of the bus control modules 2A, 2B, and 2C is removed, leaving two, arbitration control will be performed between the remaining bus control modules.

[0032] As shown in Figure 1, bus control modules 2B and 2C receive signals sent by bus control module 2A. Bus control modules 2B and 2C also send signals to bus control module 2A. If bus control module 2B fails, there is a possibility that incorrect signals will be sent to bus control modules 2A and 2C, so it is necessary to disconnect the failed bus control module 2B from bus 10. Disconnecting from bus 10 means electrically cutting off the connection to bus 10 in order to prevent unnecessary signals from being sent to bus 10.

[0033] The bus arbitration control unit 23 clearly identifies the bus control module 2 that has been diagnosed as faulty by the diagnostic unit 21, and then immediately makes the decision and takes action to disconnect the faulty bus control module 2 from the bus 10.

[0034] The notification unit 24 notifies the system of an abnormality when the diagnostic unit 21 diagnoses an abnormality. The notification of the abnormality by the notification unit 24 helps to identify the bus control module 2 that has malfunctioned, and prompts maintenance personnel to replace the module.

[0035] As mentioned above, the process of disconnecting the faulty bus control module 2 from the bus 10 must be carried out immediately. If the fault is left unattended, not only will abnormal signals be sent to the non-faulty bus control module 2, but abnormal signals will also be sent to the controlled object 12, which will disrupt real-time control of the plant.

[0036] Figure 3 is a circuit diagram of each bus control module 2. In the following explanation, bus control module 2A on the left side of Figure 3 will be referred to as bus control module YA, which is connected to slot number YA. On the right side of Figure 3, from top to bottom, bus control module 2B will be referred to as bus control module YB, which is connected to slot number YB, and bus control module 2C will be referred to as bus control module YC, which is connected to slot number YC.

[0037] Here, we will explain the signal terminals and the meaning of the signals shown in Figure 3. Here, we will describe examples using FPGAs (Field Programmable Gate Arrays) as an example of control circuits in bus control modules 2A, 2B, and 2C, respectively. However, other devices capable of operating as control circuits may also be configured in bus control modules 2A, 2B, and 2C.

[0038] The FPGA signal terminals in bus control module 2A include: self-bus right notification output enable control output 51, self-bus right notification output 52, self-bus right notification loopback input (low priority via other module) 53, low priority other module implementation notification signal 54, self-bus right notification loopback input (high priority via other module) 55, high priority other module implementation notification signal 56, and self-bus right notification outputs 57 and 58. Some terminals are indicated by their signal names.

[0039] The signals that are input and output between the local bus control module 2A and the other system's bus control module 2B are the high-priority bus right notification signal 91, the high-priority bus right notification loopback signal 92, and the module implementation signal 93, all located on the backboard (BB).

[0040] The FPGA signal terminals in the bus control module 2B are a high-priority other-system bus right notification input 71, a high-priority other-system bus right notification input 72, and a local module implementation output 73.

[0041] The signals that are input and output between the local bus control module 2A and the other system's bus control module 2C are the low-priority bus right notification signal 94, the low-priority bus right notification loopback signal 95, and the module implementation signal 96, all located on the backboard (BB).

[0042] The FPGA signal terminals in the bus control module 2C are a low-priority other-system bus right notification input 81, a low-priority other-system bus right notification input 82, and a local module implementation output 83.

[0043] The above explanation of signal terminals and signal meanings focuses on a connection configuration in which the local bus control module YA requests bus rights from the other systems' bus control modules YB and YC. Here, if bus control module YB is considered to be the local system, it can be reinterpreted as focusing on a connection configuration in which the local bus control module YB requests bus rights from the other systems' bus control modules YC and YA. Similarly, if bus control module YC is considered to be the local system, it can be reinterpreted as focusing on a connection configuration in which the local bus control module YC requests bus rights from the other systems' bus control modules YA and YB.

[0044] The bus control module YA includes an FPGA, two sets of 3-state buffers 31, and input buffers 32 and 33. The other bus control modules YB and YC each include input buffers 41 and 42, and an output buffer 43, respectively.

[0045] The two 3-state buffers 31 in the bus control module YA have a high-level self-system bus right notification output enable control output 51 input to their 3-state control terminals, and a self-system bus right notification output 52 input to their signal input terminals. The 3-state buffers 31 output the signal of the self-system bus right notification output 52 input to their signal input terminals toward the other system's bus control modules YB and YC.

[0046] The input buffer 41 of the other bus control modules YB and YC receives signals output from the 3-state buffer 31 of the bus control module YA. The FPGA of bus control module YB receives the signals from input buffer 41 as input to the high-priority other-system bus right notification input 71. The signals input to input buffer 41 are also input to input buffer 42, and the signals from input buffer 42 are received as input to the high-priority other-system bus right notification input 72 of the FPGA of bus control module YB. The signals output from the FPGA of bus control module YB are output to bus control module YA as the local module implementation output 74 of bus control module 2B, via the local module implementation output 73 and output buffer 43.

[0047] Similar to the FPGA of the bus control module YB, the signals input to input buffers 41 and 42 are input to the FPGA of the bus control module YC. The signal from input buffer 41 is input to the low-priority other-system bus right notification input 81 of the FPGA of the bus control module YC. In addition, the signal input to input buffer 41 is also input to input buffer 42, and the signal from input buffer 42 is input to the low-priority other-system bus right notification input 82 of the FPGA of the bus control module YC. The signal output from the FPGA of the bus control module YC is output to the bus control module YA as the local module implementation output 84 of the bus control module 2C, via the local module implementation output 83 and output buffer 43.

[0048] The FPGA of the local bus control module YA receives the signal output from the bus control module YB via the input buffer 33 as a low-priority notification signal 54 for the implementation of another module. At this time, the input buffer 33 inverts the input signal and outputs it, which is then input as the low-priority notification signal 54 for the implementation of another module. Similarly, the FPGA of the local bus control module YA receives the signal output from the bus control module YC via the input buffer 33 as a high-priority notification signal 56 for the implementation of another module. At this time, the input buffer 33 inverts the input signal and outputs it, which is then input as the high-priority notification signal 56 for the implementation of another module.

[0049] In this specification, high reliability means a high accuracy in fault detection to reliably prevent erroneous control. High availability means that the redundant monitoring and control system 100 can be operated safely by reliably isolating only the faulty system without the risk of misdetection. Based on this, the features of the monitoring and control system 100 according to this embodiment will be described. Furthermore, the order of processing will be explained using the numbers in parentheses in Figure 3, corresponding to each feature.

[0050] (Feature 1) The bus right notification signal that the local bus control module YA outputs to the other systems' bus control modules YB and YC is received by the local bus control module YA as a loopback through the other systems' bus control modules YB and YC, via the local bus control module YA's bus right notification loopback input (low priority via other systems' module) 53 and the local bus right notification loopback input (high priority via other systems' module) 55. This allows the local bus control module YA to confirm the health of its own system's request output status and determine if there is a fault in its own system. Specifically, in Feature 1, the diagnostic unit 21 performs a loopback diagnosis by returning the signal that the local bus control module YA sent to the other systems' bus control modules YB and YC to request bus right (bus right notification signal), via the other systems' bus control modules YB and YC as one of the signal paths. The diagnostic unit 21 diagnoses its own bus control module YA as normal if it receives a signal requesting bus rights (bus rights notification signal) from its own bus control module YA. On the other hand, the diagnostic unit 21 diagnoses that there is an abnormality in the signal transmission of its own bus control module YA if it does not receive a signal requesting bus rights (bus rights notification signal) from the signal path via the other systems' bus control modules YB and YC. The bus arbitration control unit 23 disconnects its own bus control module YA from the bus 10 if the diagnostic unit 21 diagnoses that its own bus control module YA is abnormal.

[0051] In Figure 3, (1) the local bus right notification output enable control output 51 and (2) the local bus right notification output 52 are input to (3) the 3-state buffer 31. (4) The bus right notification signal output from the 3-state buffer 31 is sent to the other system's bus control modules YB and YC. (5) The bus right notification signal output from the local bus control module YA is input to the input buffer 41 of the other system's bus control modules YB and YC. Subsequently, (6) and (7) the bus right notification signal is also input to the input buffer 42 of the other system's bus control modules YB and YC via the input buffer 41. Subsequently, (8) the bus right notification signal is input to the input buffer 32 of the bus control module YA via the input buffer 42 of the other system's bus control modules YB and YC. Finally, (9) the bus right notification signal via the other system's bus control module YB is input to the FPGA as the local bus right notification loopback input (low priority via other system module) 53. Similarly, bus right notification signals received via the other system's bus control module YC are input to the FPGA as its own system bus right notification loopback input (via high-priority other system module) 55.

[0052] (Feature 2) As described in Feature 1, the bus right notification signal sent from the local bus control module YA is acquired by the other systems' bus control modules YB and YC, respectively. In this configuration, the diagnostic unit 21 of the other systems' bus control modules YB and YC determines whether or not a fault has occurred in the input buffers 41 and 42. Therefore, in Feature 2 of the monitoring and control system 100, the other systems' bus control modules YB and YC are provided with multiple input paths for receiving the bus right notification signal sent from the local bus control module YA.

[0053] The diagnostic unit 21 of the other system's bus control modules YB and YC diagnoses them as normal if they can correctly input the bus right notification signal sent by their own system's bus control module YA through multiple input paths. On the other hand, the diagnostic unit 21 of the other system's bus control modules YB and YC diagnoses them as abnormal if they cannot correctly input the bus right notification signal through at least one of their multiple input paths.

[0054] Figure 3 shows an example where input buffers 41 and 42 are provided in the bus control modules YB and YC of other systems. However, although input buffers 41 and 42 are also provided in the bus control module YA of the own system (not shown), feature 2 will be explained using an example in which a bus right notification signal is output from the bus control module YA of the own system to the input buffers 41 and 42 of the bus control module YB of the other system.

[0055] Figure 3 shows that the bus right notification signal sent from the local bus control module YA is input to the other system's bus control module YB as follows: (5) The bus right notification signal output from the local bus control module YA is input to the input buffer 41 of the other system's bus control module YB. (6) The bus right notification signal is also input to the input buffer 42 of the other system's bus control module YB via the board wiring connected to the input buffer 41. In other words, the high-priority other system bus right notification inputs 71 and 72 of the FPGA in the other system's bus control module YB receive the same bus right notification signal from input buffers 41 and 42.

[0056] Here, it is expected that the signal values ​​taken in from input buffer 41 and input buffer 42 always match. If the signal values ​​taken in from input buffer 41 and input buffer 42 do not match, it is clear that one of the input buffers is faulty. The abnormalities or faults that can occur in either input buffer 41 or 42 include ON-fixed faults and OFF-fixed faults. The diagnostic unit 21 of the other system's bus control module YB determines that an abnormality has occurred if the signal values ​​taken in from input buffer 41 and input buffer 42 do not match, and can identify that the abnormality occurred in either input buffer 41 or input buffer 42. For example, if an abnormality occurs in either input buffer 41 or 42, the other system's bus control module YB can only detect the bus right notification signal from the one path where no abnormality has occurred. In this case, as described above, it can be identified that an abnormality has occurred in either input buffer 41 or 42 of the bus control module YB.

[0057] The bus right notification signal sent from the local bus control module YA is input to the other system's bus control module YC in the same way as to the other system's bus control module YB. Since ON-locking and OFF-locking failures can occur in the same way, the diagnostic unit 21 of the other system's bus control module YC can also identify that either the input buffer 41 or 42 of the bus control module YC has failed if it can only detect the bus right notification signal from one path.

[0058] Furthermore, the local bus control module YA also receives bus right notification signals output from other systems' bus control modules YB or YC via two input buffers (not shown). For example, the high-priority other-system bus right notification inputs 61-62 on the local bus control module YA receive bus right notification signals output from other systems' bus control module YC. Similarly, the low-priority other-system bus right notification inputs 63-64 receive bus right notification signals output from other systems' bus control module YB. In addition, the local module implementation output 65 on the local bus control module YA is connected as the high-priority other-system module implementation notification signal from other systems' bus control module YB and the low-priority other-system module implementation notification signal from other systems' bus control module YC.

[0059] (Feature 3) In Feature 1 described above, for example, if either of the other system's bus control modules YB or YC is removed from the device for maintenance and becomes unavailable, the signal path for the bus right notification signal will be interrupted. In this case, the local bus control module YA cannot input the bus right notification signal sent to the other system's bus control modules YB and YC via loopback. Therefore, the local bus control module YA may mistakenly determine that a failure has occurred in the FPGA's output terminals: the local bus right notification output enable control output 51, the local bus right notification output 52, the local output buffer 31, the input buffer 32, the FPGA's output terminals: the local bus right notification loopback input (via low-priority other system module) 53, or the local bus right notification loopback input (via high-priority other system module) 55.

[0060] Therefore, the local bus control module YA receives the other-system module implementation notification signal output by the other-system bus control modules YB and YC, allowing it to determine in advance whether the other-system bus control modules YB and YC are absent or not. For this reason, the diagnostic unit 21 of the local bus control module YA can diagnose that the other-system bus control modules 2B and 2C are connected when the other-system module implementation notification signal is input from the other-system bus control modules YB and YC. The other-system module implementation notification signal is a periodically changing pulse signal and behaves as a so-called survival pulse signal (an example of a survival signal). The bus arbitration control unit 23 of the local bus control module YA does not allow the other-system bus control modules 2B and 2C, which do not receive a survival signal, to perform a loopback diagnosis of the signal for the local bus control module YA to request bus rights. For example, if the bus arbitration control unit 23 of the local bus control module YA cannot detect the other-system module implementation notification signal as a pulse, it determines that the other-system bus control module YB or YC is absent. This clearly indicates that a loopback path for the bus right notification signal via other bus control modules has not been established, so the loopback diagnostics are temporarily suspended during this time.

[0061] In Figure 3, (10) the implementation notification signal output from the local module implementation output 73 of the other system's bus control module YB is inverted and input to the output buffer 43. Subsequently, (11) the implementation notification signal is output from the output buffer 43 to the local system's bus control module YA. Subsequently, (12) the implementation notification signal is input to the bus control module YA via the backboard (BB) as a module implementation signal 93. Subsequently, (13) the implementation notification signal is input to the input buffer 33 of the bus control module YA. Finally, (14) the implementation notification signal is inverted and output to the input buffer 33 and input to the FPGA terminal as a low-priority other system module implementation notification signal 54. The diagnostic unit 21 of the local system's bus control module YA determines that the other system's bus control module YB is connected if it can input the input low-priority other system module implementation notification signal 54 as a survival pulse signal.

[0062] Similarly, (10) the implementation notification signal output from the local module implementation output 83 of the other system's bus control module YC is inverted and input to the output buffer 43. Subsequently, (11) the implementation notification signal is output from the output buffer 43 to the local system's bus control module YA. Subsequently, (12) the implementation notification signal is input to the bus control module YA via the backboard (BB) as a module implementation signal 96. Subsequently, (13) it is input to the input buffer 33 of the bus control module YA. Finally, (14) the implementation notification signal is inverted and output to the input buffer 33 and input to the FPGA terminal as a high-priority other system module implementation notification signal 56. The diagnostic unit 21 of the local system's bus control module YA determines that the other system's bus control module YC is connected if it can input the input high-priority other system module implementation notification signal 56 as a life pulse signal.

[0063] (Feature 4) In features 1 and 2 described above, the diagnostic unit 21 of the bus control module on the local system can determine whether or not a fault has occurred on the local system. If the bus arbitration control unit 23 diagnoses the local system's bus control module 2 as abnormal by the diagnostic unit 21, it disconnects the local system's bus control module 2 in order to stop the output of a signal for the local system's bus control module to request bus rights. Specifically, if the diagnostic unit 21 determines that a fault has occurred on the local system, the bus arbitration control unit 23 uses two means to reliably stop the issuance of the bus rights notification signal. This prevents interference with bus access control by bus control modules of other systems. Here, the first of the two means is to turn OFF the local system bus rights notification output enable control output 51. The second means is to turn OFF the local system bus rights notification output 52 (no bus rights request).

[0064] A normal 3-state buffer 31 maintains the ON state of its own-system bus right notification output enable control output 51, thereby constantly reflecting the signal state input from its own-system bus right notification output 52 to the other-system bus control modules YB and YC. However, if one of the 3-state buffers 31 fails due to some abnormality, it is necessary to quickly stop the operation of the 3-state buffer 31. Therefore, the bus arbitration control unit 23 reliably stops the 3-state buffer 31 by turning OFF its own-system bus right notification output enable control output 51 and also turning OFF its own-system bus right notification output 52.

[0065] (Feature 5) In the aforementioned Feature 3, if the implementation notification signal experiences a stuck failure, the presence of the other party cannot be confirmed. A stuck failure, in this context, refers to a failure where, for example, the implementation notification signal of another module is not detected as a pulse signal and remains at a high or low level for a certain period of time or longer.

[0066] Here, we assume that the output buffer 43 or the input buffer 33 experiences a high-level or low-level stuck failure. In this case, the bus control module YA cannot detect the live pulse signal. This means that the local bus control module YA has lost the ability to determine the implementation status of the other system's bus control modules, and consequently, it cannot determine whether to secure a loopback path for the local bus right notification signal. Under these circumstances, the local bus control module YA may mistakenly determine that a failure has occurred in the FPGA's output terminal's local bus right notification output enable control output 51, or local bus right notification output 52, or the local output buffer 31, or input buffer 32, or the FPGA's output terminal's local bus right notification loopback input (via low-priority other system module) 53, or local bus right notification loopback input (via high-priority other system module) 55. Therefore, the local bus control module YA determines that a loopback path for the bus right notification signal via the other system's bus control modules has not been established, and temporarily suspends the loopback diagnosis during that time.

[0067] (Feature 6) Feature 6 supplements Feature 5 described above. In Feature 5, for example, if the bus control modules YB and YC of another system are removed, a Low signal is input by a pull-down resistor located before the input buffer 33 of the bus control module YA of the same system. However, the same situation occurs if the output buffer 43 of the bus control modules YB and YC of another system becomes stuck at Low. In this case, the diagnostic unit 21 cannot distinguish between the removal of the bus control modules YB and YC of another system and the Low stuck failure of the output buffer 43. Furthermore, if the output buffer 43 of the bus control modules YB and YC of another system becomes stuck at High, the diagnostic unit 21 can distinguish this from removal, but cannot distinguish it from the Low stuck failure of the input buffer 33.

[0068] Therefore, the bus control modules YA, YB, and YC notify maintenance personnel of a fault in the implementation notification signal path via a notification unit 24 consisting of LEDs and status registers. The bus control module that has experienced a fault can be identified by the combination of notifications from each bus control module.

[0069] For example, if output buffer 43 fails with a low-fixed fault, the two bus control modules to which the buffer does not belong will signal the absence of the bus control module to which the buffer belongs by lighting up their LEDs. In this case, even though the bus control module to which the buffer belongs is installed, the absence will be indicated by the LED lighting up on the two other bus connection modules, so it can be identified that the bus control module whose LED is not lit is the one that has failed. On the other hand, if input buffer 33 fails with a high-fixed output, the absence will be indicated by the LED lighting up on only the bus control module to which the buffer belongs, so it can be identified that the bus control module whose LED is lit is the one that has failed.

[0070] Furthermore, for example, if output buffer 43 fails with a fixed high output, the two bus control modules that do not belong to this buffer will detect the fixation and notify by lighting up their LEDs. In this case, it can be determined that the failure is in the bus control module whose LED is not lit. On the other hand, if input buffer 33 fails with a fixed low output, only the bus control module to which this buffer belongs will detect the fixation and notify by lighting up its LED. In this case, it can be determined that the failure is in the bus control module whose LED is lit.

[0071] (Feature 7) If the 3-state buffer 31 (output buffer) fails to be ON, the bus control module YA of its own system will attempt to stop its output by two means after determining that it has failed. However, if the final stage output of the 3-state buffer 31 is in a failure mode where it is ON, an ON signal will continue to be input to the bus control modules YB and YC of the other systems. Therefore, in Feature 7, the bus control modules YB and YC of the other systems detect this ON-fixed failure with a timeout (CONF_TO). From then on, the bus control modules YB and YC of the other systems will disable, or ignore, the input from the bus control module YA of their own system until this ON-fixed state is resolved, that is, until OFF is detected. This mechanism shown in Feature 7 is based on the premise that the bus control module YA, which is outputting an ON-fixed state, will reliably detect the loopback abnormality and autonomously shut down. Note that "until OFF is detected" here refers to the situation until the failed bus control module YA is replaced. Therefore, even if an ON-fixed failure occurs at the final stage output of the 3-state buffer 31, the bus access operation of other bus control modules YB and YC will not be blocked.

[0072] Next, the bus arbitration protocol will be explained with reference to Figure 4. Figure 4 is a state transition diagram showing an example of a bus arbitration protocol.

[0073] First, let's define the terminology. Status: This is information (presence and type of abnormality, arbitration timeout, etc.) that the FPGA reflects in the RAS register (not shown) to inform the higher-level controller. The status is also used to identify the location of the fault. Reset: This indicates that the memory elements (such as flip-flops, not shown) of the hardware, including the FPGA, have been initialized. A reset returns the above-mentioned statuses and other elements to their initial state. Bus Right Notification ON: This indicates that the system has asserted its right to access bus 10. If the system's own bus control module YA is ON, and all other systems' bus control modules YB and YC are OFF for a certain period of time, the system's own bus control module YA will determine that it has acquired bus rights and will access bus 10. Bus right relinquishment: This refers to the relinquishment of bus rights after completing bus access, following the acquisition of bus rights and the subsequent access. In other words, it means that the bus control module that held bus rights changes its bus right notification signal from ON to OFF. Request Withdrawal: This means that the system's bus control module attempted to request bus access by outputting a "bus right notification signal" ON, but upon detecting a bus right request from another system's bus control module with a higher priority setting, it changes its own bus right notification output from ON to OFF and withdraws the request.

[0074] Next, the bus arbitration protocol will be explained. The operation of the bus control module YB will be described below. While the operation in each state is performed by the bus arbitration control unit 23 of the bus control module YB, it will be described as if it were performed by the bus control module YB itself.

[0075] First, as shown in the upper part of Figure 4, when the reset of the hardware (e.g., FPGA) that comprises the bus control module YB is released, the bus control module YB transitions to IDLE mode. In IDLE mode, the bus control module YB does not hold bus rights and turns off its own bus rights notification output.

[0076] When a bus right request is issued from the higher-level controller 1B connected to the bus control module YB, the bus control module YB transitions to NY_REQ. NY_REQ is the state in which no bus right request has been made yet, that is, the state just before the system's bus right notification output is turned ON. A mediation monitoring period is provided for NY_REQ and the following BREQ, and the mediation monitoring timer for mediation monitoring is started at the timing of the transition from each state to NY_REQ.

[0077] Next, we will explain the state transitions shown in (1) of the bus control module YB. The bus control module YB confirms that the high-priority other-system bus right notification input is OFF and the low-priority other-system bus right notification input is OFF, and upon determining that there are no preceding other systems, it transitions to BREQ. In BREQ, the bus control module YB indicates that it is requesting bus right, and therefore turns on its own system's bus right notification output. In BREQ, arbitration monitoring from NY_REQ continues. Also, at the time of transitioning to BREQ, the WAIT timer by timer 22 is reset and started.

[0078] Bus control module YB transitions to ACS after the WAIT timer expires and input confirmation (high priority other-system bus right notification input = OFF, and low priority other-system bus right notification input = OFF) is performed. In other words, bus control module YB transitions to ACS after confirming that no bus right requests have been made by any other-system bus control modules YA and YC. ACS is the state in which bus control module YB acquires bus right and accesses bus 10. At this time, bus control module YB maintains the ON state for its own system's bus right notification output. The WAIT timer is a value determined by the FPGA's operating clock frequency and the board, and can be kept within, for example, several hundred nanoseconds.

[0079] The bus control module YB transitions from ACS to IDLE when bus access is complete. At this point, it is necessary to relinquish bus rights, so it outputs the bus rights notification output of its own system to OFF.

[0080] Here, as shown in Figure 3, the ON output of the self-system bus right notification outputs 57 and 58 indicates that the bus control module is requesting and holding bus right. The OFF output of the self-system bus right notification outputs 57 and 58 indicates that the bus control module is not requesting bus right. In BREQ and ACS, shown by the dashed box in Figure 4, the bus control module outputs the self-system bus right notification outputs 57 and 58 to ON. In systems other than BREQ and ACS, the bus control module outputs the self-system bus right notification outputs 57 and 58 to OFF.

[0081] Next, we will explain the state transition of bus control module YB shown in (2) when two bus rights requests are issued simultaneously. Assume that bus control module YA, which has higher priority than bus control module YB, also transitions to BREQ at almost the same time that bus control module YB transitions to BREQ. Then, bus control module YB detects bus control module YA's bus rights notification output ON as a higher priority other-system bus rights notification ON, and, being of lower priority, transitions to NY_REQ. Meanwhile, since bus control module YA, being of higher priority, can remain in BREQ, arbitration is successful upon the expiration of the WAIT timer, and it transitions to the next ACS. On the other hand, assume that bus control module YC, which has lower priority than bus control module YB, also transitions to BREQ at almost the same time that bus control module YB transitions to BREQ. In this case, since there are no transition conditions, bus control module YB remains in BREQ, and during that time bus control module YC transitions to NY_REQ. Then, the bus control module YB successfully completes the arbitration upon the expiration of the WAIT timer and transitions to the next ACS.

[0082] Next, we will explain the state transitions of bus control module YA shown in (3) when three parties simultaneously issue bus right requests. Assume that bus control module YA transitions to BREQ at almost the same time that the other systems' bus control modules YB and YC also transition to BREQ. Then, each of the bus control modules YA, YB, and YC will detect the other systems' bus right notification output ON as a high-priority other system notification ON. At this time, a so-called three-way deadlock occurs, so each immediately withdraws its bus right request and sets its bus right notification output to OFF. At this time, bus control modules YB and YC transition to NY_REQ as described above, while only bus control module YA transitions to NEXT_WAIT. When bus control module YA transitions to NEXT_WAIT, the WAIT timer is reset and started again. Upon the expiration of the WAIT timer, bus control module YA transitions from NEXT_WAIT to NY_REQ. In other words, only the bus control module YA intentionally delays the timing of its transition to NY_REQ.

[0083] As described above, bus control modules YB and YC, which quickly transitioned to NY_REQ due to the withdrawal of the bus right request from the three-way deadlock, will check for bus right notifications from other systems again at this time. However, since each system has just turned OFF its bus right notification output, bus control modules YB and YC may simultaneously detect that the high-priority other system bus right notification input is OFF, and both may transition back to BREQ. However, at the timing of this re-transition, bus control module YA is still in NEXT_WAIT, so even if there is another simultaneous arrival, it can be reliably limited to a two-system simultaneous arrival. The processing of subsequent two-system simultaneous arrivals is as described above.

[0084] Next, we will explain arbitration timeout (TO) monitoring. Arbitration timeout (TO) monitoring is designed to allow temporary withdrawal from the bus arbitration process if bus rights cannot be acquired within a certain period after a bus rights request, and aims to prevent a deadlock in the state control for bus arbitration. Note that since the bus arbitration process is time-coordinated, arbitration timeouts (TO) do not usually occur. In other words, the occurrence of an arbitration timeout (TO) indicates that a failure, including a malfunction, has occurred. For example, if a normal bus transaction takes 1 microsecond, but a bus transaction from a preceding system with an anomaly takes 10 microseconds, the system monitoring arbitration timeouts will detect this as an anomaly and perform error processing.

[0085] The following describes the operation of the bus control module YA. The bus control module YA starts the arbitration timeout (TO) monitoring timer when it enters (transitions) to NY_REQ. Specifically, this occurs when it enters (transitions) from IDLE to NY_REQ, or from NEXT_WAIT to NY_REQ, or from BREQ to NY_REQ.

[0086] CONF_TO indicates the arbitration timeout status. After error handling by the bus control module YA is complete, the status is updated by writing the error details to the RAS register, and the system transitions to IDLE. The higher-level controller 1A connected to the bus control module YA can check the error details written to the RAS register.

[0087] Based on the bus arbitration protocol described above, we will now explain how the bus arbitration function according to this embodiment is performed at high speed without significantly affecting the bus cycle time.

[0088] (Feature 1) Bus control modules YA-YC will prioritize requests for bus rights from the time they are made until they successfully acquire those rights. If a bus control module in one system detects that another system's bus control module has already issued a bus rights request before the first system's bus control module issues one, the system's bus control module will withhold its request.

[0089] (Feature 2) If multiple bus control modules YA~YC simultaneously request bus rights, the modules YA~YC are set to high priority and low priority in a circular pattern. Bus control modules set to low priority temporarily withdraw their bus rights request and wait for an opportunity to resubmit it.

[0090] (Feature 3) In the configuration shown in Feature 2, exceptionally, a waiting period is set for the bus control module YA only, before a bus right request is reissued after a bus right request has been withdrawn. This ensures that the order of bus right requests is reliably sorted to two or fewer simultaneous requests immediately after a three-way stalemate.

[0091] (Feature 4) A fixed WAIT timer is used to hold the bus right request from each bus control module YA to YC until the acquisition of the bus right is confirmed. This is because there is a time lag due to transmission delay in the bus right notification signal indicating the bus right request, and this is done to avoid its effects. Specifically, in the series of steps described in Feature 1, which involves checking whether other bus control modules have issued a bus right request and then issuing one's own bus right request, the possibility of conflicting and coexistence of bus right requests from one system and another cannot be eliminated due to the time lag caused by transmission delay. Therefore, to prevent a bus collision that occurs when bus operation actually starts due to this coexistence, a hold period is set up to ensure that the arbitration process described in Feature 2 is carried out reliably.

[0092] Next, we will explain bus mediation with reference to Figures 5 and 6. Figure 5 is a timing chart showing examples of bus arbitration in cases with no ties and in cases of two ties. Figure 6 is a timing chart showing an example of bus arbitration in cases of three ties. These timing charts simulate the bus right notification signals of each bus control module, with High indicating the bus right notification signal is ON and Low indicating the bus right notification signal is OFF. The main state names from Figure 4 are also included. Below, bus arbitration will be explained using Case numbers assigned to Figures 5 and 6.

[0093] The triangular symbols shown in the diagram indicate bus right request instructions received via the communication line from the CPU (not shown) that constitutes controller 1. The shaded box diagrams spanning bus control modules YA to YC indicate periods on the FPGA backboard when none of YA to YC are transmitting the bus right notification signal.

[0094] (No tie: Case 1) In Case 1, none of the bus control modules YA to YC hold bus rights. Bus control module YA then turns on the bus rights notification signal and acquires bus rights. As shown in Figure 4, bus control module YA transitions from IDLE to NY_REQ, and then from BREQ to ACS. Subsequently, while bus control module YA is in the middle of BREQ, bus control module YB transitions to NY_REQ. At this point, bus control module YB has confirmed that the bus rights notification signal of the first bus control module YA has been turned ON, and therefore remains in NY_REQ, waiting for bus control module YA to relinquish bus rights and turn off the bus rights notification signal.

[0095] (No tie: Case 2) In Case 2, bus control module YA relinquishes bus rights, causing bus control module YB to transition from NY_REQ to BREQ and acquire bus rights. The sequence of events in Cases 1 and 2 is the same for other combinations of bus control modules YA to YC, so explanations for other combinations are omitted.

[0096] (No tie: Case 3) Case 3 describes a situation where bus control module YC has acquired bus rights, and bus control modules YA and YB, having received bus rights requests from the CPU, are waiting in NY_REQ mode. This is a derivative case of Case 1.

[0097] Next, we will explain simultaneous arrival of two bus control modules. When bus rights arise in conflict, the aforementioned rules apply, but the assignment of higher priority (Prio) and lower priority (Surrender) between bus control modules is determined by the wiring on the backboard of the printed circuit board. Therefore, the priority determination of bus control modules YA to YC in simultaneous arrival of two bus control modules is made based on the following priority relationships. (a) If bus control module YA and bus control module YB arrive at the same time, bus control module YA will be given priority. (b) If bus control module YB and bus control module YC arrive at the same time, bus control module YB will be given priority. (c) If bus control module YC and bus control module YA arrive at the same time, bus control module YC will be given priority.

[0098] In the case of a tie between two bus control modules, the bus arbitration control unit 23, according to a pre-set priority order for the multiple bus control modules 2, ensures that the bus control module 2 with the higher priority acquires bus rights, and the bus control module 2 with the lower priority withdraws its bus rights claim. Subsequently, after the bus control module 2 with the higher priority relinquishes bus rights upon completion of its bus operation, the bus arbitration control unit 2 then ensures that the next bus control module 2 with the lower priority acquires bus rights. Cases 4 to 6 of a tie between two bus control modules are described below.

[0099] (Two people tied: Case 4) Bus control modules YA and YB arrive at the same time. Bus control modules YA and YB will wait for bus control module YC, which acquired bus rights in Case 3, to relinquish its bus rights before requesting bus rights themselves. However, since it is a tie, the higher-priority bus control module YA acquires bus rights, and bus control module YB temporarily withdraws its request for bus rights. After bus control module YA relinquishes bus rights, bus control module YB acquires bus rights.

[0100] (Two people tied: Case 5) Bus control modules YA and YC wait for bus control module YB, which acquired bus rights in Case 4, to relinquish its bus rights before issuing bus rights requests. However, since both are at the same time, the higher-priority bus control module YC acquires bus rights, and bus control module YA temporarily withdraws its bus rights request. As shown in Figure 4, bus control module YA transitions to NEXT_WAIT, waits for the time set by the WAIT timer, and then transitions to NY_REQ. After bus control module YC relinquishes bus rights, bus control module YA acquires bus rights.

[0101] (Two people tied: Case 6) Bus control modules YB and YC wait for bus control module YA, which acquired bus rights in Case 5, to relinquish its bus rights before issuing bus rights requests. However, since both are at a tie, the higher-priority bus control module YB acquires bus rights, and bus control module YC temporarily withdraws its bus rights request. Subsequently, bus control module YC acquires bus rights after bus control module YB relinquishes its bus rights.

[0102] In the case of a three-way tie, the bus arbitration control unit 23 determines the relationship between the bus control modules 2 and the bus right requests issued by all of them according to a pre-set circular priority order, resulting in a three-way stalemate. Therefore, all bus control modules 2 withdraw their bus right requests. Since all bus right requests are withdrawn, the bus control modules 2 issue bus right requests again, but here, one bus control module (for example, bus control module YA) is intentionally delayed in issuing its bus right request by a predetermined time counted by the timer 22. This prevents a two-way tie in the subsequent bus right request issuance.

[0103] (3-way tie: Case 7) Case 7 begins with none of the bus control modules YA, Y, or C holding bus rights. Then, all three bus control modules YA, Y, or C simultaneously issue bus rights requests. At this point, a three-way tie occurs, causing a circular conflict in the priority determination process. As a result, all three bus control modules YA, Y, or C withdraw their bus rights requests. Subsequently, bus control module YA transitions to NEXT_WAIT, waits for the WAIT timer, and then transitions to NY_REQ. In this way, bus control module YA delays the timing of its next bus rights request by a predetermined time counted by timer 22. Meanwhile, bus control modules YB and YC reissue bus rights requests immediately after withdrawing their previous requests, thus reliably avoiding a three-way tie at this reissue timing. Note that in this reissue, bus control modules YB and YC may end up with a two-way tie, which corresponds to Case 6.

[0104] In the monitoring and control system 100 according to the embodiment described above, bus arbitration processing is performed at high speed within the bus cycle period of each bus control module 2 configured in the multiplexing unit (for example, the total length of BREQ and ACS shown in Figure 5). In addition, since the diagnostic unit 21 performs self-diagnosis in parallel with bus arbitration, if a component at an inseparable level in the bus arbitration function part shown in Figure 1 fails, the faulty system can be identified and safely and immediately isolated from the bus 10. Therefore, the availability of the multiplexed monitoring and control system 100 can be maintained, and highly reliable bus arbitration can be performed. In other words, it becomes possible to perform bus arbitration that enables clear identification of the faulty part and reliable isolation of the faulty part.

[0105] As mentioned above, the diagnostic unit 21 can detect and isolate faults within the bus cycle period. A bus control module 2 identified as potentially faulty is isolated from the bus 10. This process is designed to avoid affecting the normal operation of other functioning bus control modules 2. This fault identification process by the diagnostic unit 21 is significantly faster than conventional fault identification techniques.

[0106] In a redundant plant monitoring and control system, it is common practice for only one master to have the authority to output process data from the controller to the controlled object. However, process input from the controlled object to the controller is not necessarily limited to only one master. For example, process input signals from the controlled object being monitored may be input by multiple redundant controllers. In fact, the ability for a master without execution authority for monitoring and control (e.g., a standby controller) to always receive process input at its respective processing timing contributes to the decentralization of plant monitoring and control, and to faster switching during controller system failover by eliminating the process data matching process. From another perspective, it also offers the advantage of expanding the standby system diagnostic range for the standby controller. Specifically, by having the bus control module 2 connected to the standby controller access the bus 10 and acquire process input data from the controlled object 12, it becomes possible to simultaneously confirm that the bus access function of the standby bus control module is working correctly.

[0107] In conventional technology, a system that performs permission notification responses may be considered to have failed and shut down if a response timeout is detected. However, since the receiving side of the permission notification may also be faulty, the above fault determination is not perfect. On the other hand, the arbitration control device according to this embodiment can clearly distinguish whether the faulty part is the signal output source or the input destination.

[0108] Furthermore, although the above-described embodiment was an example in which three bus control modules 2 performed bus arbitration control, four or more bus control modules 2 may also perform bus arbitration control. In the case of a tie, the bus control module 2 that acquires bus rights may be determined according to a predetermined priority order.

[0109] It should be noted that the present invention is not limited to the embodiments described above, and various other applications and modifications can be taken as long as they do not deviate from the gist of the present invention as described in the claims. For example, the embodiments described above are detailed and specific explanations of the system configuration in order to clearly illustrate the present invention, and are not necessarily limited to having all the configurations described. Furthermore, it is possible to add, delete, or replace some of the configurations in these embodiments with other configurations. Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected. [Explanation of Symbols]

[0110] 1,1A~1C…Controller, 2,2A~2C…Bus control module, 10…Bus, 11,11A,11B…Input / Output control module, 12…Controlled object, 21…Diagnostic unit, 21…Timer, 23…Bus arbitration control unit, 24…Notification unit, 100…Monitoring and control system

Claims

1. An arbitration control device that arbitrates the granting of bus rights for multiple bus right request modules connected to a bus to output a signal to the bus, The aforementioned bus rights request module of its own system, A diagnostic unit that diagnoses the operational health of the bus right request module in its own system and the bus right request module in another system, and identifies the bus right request module in which a failure has occurred, The diagnostic unit diagnoses the bus right request module of its own system and the bus right request module of the other system as normal, and determines whether the bus right requests of the bus right request module of its own system and the bus right request module of the other system are simultaneous. If it determines that the bus right requests are simultaneous, the bus arbitration control unit arbitrates the acquisition of the bus right between the bus right request module of its own system and the bus right request module of the other system based on a predetermined priority order. Mediation control device.

2. The diagnostic unit performs a loopback diagnosis via the other system's bus right request module of the bus right request module, receiving a signal from the local system's bus right request module to the other system's bus right request module for requesting bus rights. If the local system's bus right request module returns a signal requesting bus rights, the diagnostic unit diagnoses the local system's bus right request module as normal. If the signal requesting bus rights does not return via the other system's bus right request module, the diagnostic unit diagnoses the local system's bus right request module as abnormal. The bus arbitration control unit disconnects the bus right request module of its own system when the diagnostic unit diagnoses that the bus right request module of its own system is abnormal. The arbitration control device according to claim 1.

3. The bus right request module of the other system is equipped with multiple input paths to which signals for requesting the bus right, which are sent from the bus right request module of the own system, are input. The diagnostic unit of the bus right request module of the other system diagnoses the bus right request module of the other system as normal if the signal for requesting the bus right sent by the bus right request module of the own system is correctly input through multiple input paths, and diagnoses the bus right request module of the other system as abnormal if the signal for requesting the bus right cannot be correctly input through at least one of the multiple input paths. The mediation control device according to claim 2.

4. The diagnostic unit diagnoses that the bus right request module of the other system is connected when a life signal is input from the bus right request module of the other system, and diagnoses that the bus right request module of the other system is not connected when no life signal is input. The bus arbitration control unit prevents the bus right request module of another system, which does not receive the life signal, from performing the loopback diagnosis of the signal for which the bus right request module of its own system requests bus right. The mediation control device according to claim 3.

5. The diagnostic unit includes a notification unit that notifies the occurrence of an abnormality when it diagnoses an abnormality. The mediation control device according to claim 4.

6. The bus arbitration control unit, when the diagnostic unit diagnoses that the bus right request module of its own system is abnormal, stops the output of a signal for the bus right request module of its own system to request the bus right, as described in claim 5.

7. The bus right request module in the local system and the bus right request module in the other system notify the occurrence of a failure via the notification unit, and the bus right request module experiencing the failure is identified by the combination of notifications from the local system's bus right request module and the bus right request module in the other system. The mediation control device according to claim 5.

8. The bus arbitration control unit, in accordance with the pre-set priority order for the multiple bus right request modules, when at least two of the bus right request modules request the bus right at the same time, the bus right request module with the higher priority acquires the bus right, the bus right request module with the lower priority withdraws its bus right request, and after the bus right is relinquished upon completion of the bus operation by the bus right request module with the higher priority, the next bus right request module with the lower priority acquires the bus right. The mediation control device according to claim 3.

9. It has a timer that counts time, The bus arbitration control unit sets a priority for the multiple bus right request modules, and if three or more bus right request modules request the bus right at the same time, after all the bus right request modules have withdrawn their bus right requests, at least one bus right request module delays the timing of requesting the bus right again by a predetermined time counted by the timer. The mediation control device according to claim 8.

10. A mediation control method performed by a mediation control device that mediates the granting of bus rights for multiple bus right request modules connected to a bus to output a signal to the bus, wherein Each of the aforementioned bus rights request modules is: The steps include diagnosing the operational health of the bus right request module in the own system and the bus right request module in the other system, and identifying the bus right request module in which a failure has occurred, The system includes the step of determining whether the bus right requests from the system's bus right request module and the other system's bus right request module are simultaneous, and if it is determined that the bus right requests are simultaneous, mediating the acquisition of the bus right based on the priority set in advance between the system's bus right request module and the other system's bus right request module. Mediation and control methods.

Images