Process control system, process control device, and program update method

Abstract

To realize feature expansion of online system update without stopping a process control system.SOLUTION: A process control system includes a first process controller and a second process controller. The second process controller includes: a data transfer unit which acquires, from the first process controller, transfer data as data to be transferred in order to continue a system function upon switching from the first process controller to the second process controller, and restores the data at the second process controller; and a timing determination unit which determines timing for performing switching.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to a process control system, a process control device, and a program update method.

Background Art

[0002] Conventionally, in plants, factories, etc. (hereinafter, when collectively referring to these, simply referred to as "plants"), a process control system for controlling various state quantities (e.g., pressure, temperature, flow rate, etc.) in an industrial process has been constructed, and highly automated operation has been realized. In such a process control system, it may be necessary to replace hardware or improve software. Examples of software improvement include expanding the functions of an operating system (OS) and fixing defects / vulnerabilities in the operating system.

[0003] Patent Document 1 below discloses an invention that enables updating a program to be updated simply and in a short time while continuously operating a process control system in a process control system equipped with dualized process control devices (a current device and an update device). Specifically, in the current device, a non-update target program that is not the update target is temporarily stopped, and only the context of the non-update target program is transferred from the current device to the update device. In the update device, the context of the non-update target program is restored using the transferred context, the context of the update target program is initialized, and the non-update target program and the update target program are restarted in the update device.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] In order to update the system program according to the invention disclosed in Patent Document 1, it is necessary to incorporate a function (hereinafter referred to as the "online update function") required to realize online system update into both the current device and the update device. "Online system update" means updating the system program while continuing the processing of the function (system function) realized by the system program.

[0006] However, although the above online update function can be easily incorporated into the update device in the standby state, it cannot be incorporated into the current device in the operating state. For this reason, in order to incorporate the above online update function into the current device, there is a problem that the current device needs to be stopped once.

[0007] The present invention has been made in view of the above circumstances, and an object thereof is to provide a process control system, a process control device, and a program update method capable of realizing an extended function of online system update without stopping the process control system.

Means for Solving the Problems

[0008] In order to solve the above problems, a process control system according to an aspect of the present invention is a process control system (1) including a first process control device (10) and a second process control device (20), wherein the second process control device includes: a data transfer unit (24b) that acquires transfer data (DT), which is data that needs to be transferred in order to continue the system function when the switch from the first process control device to the second process control device is performed, from the first process control device and restores it to the second process control device; and a timing determination unit (24c, 24f) that determines the timing for performing the switch.

[0009] In a process control system according to an aspect of the present invention, the data transfer unit may acquire the transfer data from the first process control device by referring to a symbol table (TB1) of the system function in the first process control device.

[0010] In a process control system according to an aspect of the present invention, the timing determination unit may determine the timing so that the switching is performed after confirming that all of the system functions in the first process control device are in a completed state where processing has been completed.

[0011] In a process control system according to an aspect of the present invention, the timing determination unit may abort the switching if the completed state cannot be confirmed.

[0012] A process control system according to an aspect of the present invention further includes an address conversion unit (24e) that, when the transfer data is an address value of a variable stored in an address variable region where the address may vary, uses an address conversion table (TB2) in which the address of the variable stored in the address variable region before the switching is performed and the address of the variable stored in the address variable region after the switching is performed are associated with each other to convert the address value as the transfer data.

[0013] In a process control system according to an aspect of the present invention, the address conversion table may be generated in advance using a symbol table of the system function in the first process control device and a symbol table of the system function in the second process control device.

[0014] In a process control system according to an aspect of the present invention, the first process control device includes a cache operation unit (14a) that operates a cache for temporarily holding data used internally in a state where the data cannot be referenced from the second process control device. When determining the timing, the timing determination unit may perform an operation on the cache operation unit to make the data held by the cache referable from the second process control device.

[0015] In a process control system according to an aspect of the present invention, the timing determination unit can perform an operation to enable or disable the cache on the first process control device.

[0016] In a process control system according to an aspect of the present invention, the symbol table (TB1) may be a table generated by compiling and linking a system program that realizes a system function in the first process control device.

[0017] In a process control system according to an aspect of the present invention, the data transfer unit (24b) may obtain the address where the transfer data (DT) is stored in the first process control device by referring to the symbol table (TB1).

[0018] In a process control system according to an aspect of the present invention, the timing is between when the processing to be executed in a certain control cycle of the first process control device ends and when the next control cycle starts, and may be a timing that is a predetermined time before the time when the next control cycle starts.

[0019] In a process control system according to an aspect of the present invention, the predetermined time may be a time obtained by adding the time required for the timing determination unit (24c, 24f) to confirm the completion state of the first process control device and the time required for the data transfer unit to obtain the transfer data from the first process control device and restore it to the second process control device.

[0020] In a process control system according to one aspect of the present invention, the address variation area may be composed of one or more areas with consecutive addresses, and each area may be managed by a start address and a size.

[0021] A process control device according to one aspect of the present invention is a process control device (20) in which switching from another device to the own device is performed, and a data transfer unit (24b) that acquires transfer data, which is data that needs to be transferred in order to continue the system function when the switching is performed, from another device and restores it to the own device, and a timing determination unit (24c, 24f) that determines the timing for performing the switching.

[0022] A program update method according to one aspect of the present invention is a program update method in a process control system (1) including a first process control device (10) and a second process control device (20), and the second process control device acquires transfer data (DT), which is data that needs to be transferred in order to continue the system function when switching from the first process control device to the second process control device, from the first process control device and restores it to the second process control device in a data transfer step (S14), and the second process control device has a timing determination step (S13) for determining the timing for performing the switching.

Advantages of the Invention

[0023] According to the present invention, it is possible to realize an expansion of the function of online system update without stopping the process control system.

Brief Description of the Drawings

[0024]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Embodiments for Carrying Out the Invention

[0025] Hereinafter, with reference to the drawings, a process control system, a process control device, and a program update method according to embodiments of the present invention will be described in detail. First, an overview of the embodiments of the present invention will be described, and then the details of each embodiment will be described.

[0026] 〔Overview〕 Embodiments of the present invention are to realize an extended function of online system update without stopping the process control system. Since the process control system is required to operate continuously for a long period of months to years in order to improve production efficiency as much as possible, it is almost impossible to freely stop the process control system in the operating state. For example, except for stoppage due to regular maintenance or shutdown performed to ensure plant safety, basically, it is not allowed to stop the process control system. The reason is that, taking a chemical process as an example, if an unexpected interruption occurs during the process of continuing a chemical reaction, the semi-finished products produced up to that point may become unusable, resulting in a large loss.

[0027] On the other hand, since the process control system is required to be free from malfunctions and operational failures from the perspective of safety, if a cause that can lead to malfunctions or the like (for example, defects or vulnerabilities in the operating system) is discovered, it is necessary to immediately take measures (update of the operating system) to eliminate the cause. However, as described above, since the process control system cannot be freely stopped, even if a cause that can lead to malfunctions or the like is discovered, there may be cases where the measures cannot be taken immediately.

[0028] By using the invention disclosed in Patent Document 1 described above, it is also possible to update the system program (online system update) while continuing the processing of the functions (system functions) realized by the system program. However, in order to update the system program according to the invention disclosed in Patent Document 1 described above, it is necessary to incorporate the online update function required to realize the online system update into both the current device and the update device.

[0029] However, although the above online update function can easily incorporate the extension function into the update device in the standby state, it cannot be incorporated into the active device in the operating state. That is, even if the extension function of online update is realized in the active device, it means that the extension function cannot be used when the next online update is performed. For example, a specific system function had a constraint that the processing stopped during the conventional online update, but with the extension function of online update, the processing can continue. In this case, it is necessary to use the conventional online update once and incorporate the extension function into the conventional online update function of the active device. Therefore, when using the conventional online update, it is necessary to stop a specific system function.

[0030] In the embodiment of the present invention, when switching from the active device (the first process control device) to the update device (the second process control device), the update device acquires the data (handover data) that needs to be handed over in order to continue the system function from the active device and restores it to the update device. The update device determines the timing for switching from the active device to the update device. In this embodiment, it is only necessary to incorporate the online update function required to realize the online system update into the update device, and there is no need to incorporate it into the active device. Therefore, the function expansion of the online system update can be realized without stopping the process control system.

[0031] 〔First Embodiment〕 〈Process Control System〉 FIG. 1 is a functional configuration diagram showing the schematic functional configuration of a process control system according to the first embodiment of the present invention. As shown in FIG. 1, the process control system 1 of the present embodiment includes a process control device 10 (first process control device), a process control device 20 (second process control device), and an engine device 30. The process control device 10 and the process control device 20 are realized using computers of the same or similar scale. In the present embodiment, the process control device 10 may be referred to as the "active device", and the process control device 20 may be referred to as the "update device". The "active device" means the device that is currently operating, and the "update device" means the device that is not currently operating and is standing by for program update.

[0032] In the present embodiment, in order to update the program, the function that was operating in the process control device 10 is switched to the process control device 20. That is, initially, the process control device 10, which is the active device, operates to control the process, and the process control device 20, which is the update device, stands by. Thereafter, based on a command signal from the engine device 30, the function in the process control device 10 (active device) is temporarily stopped, and the function is resumed in the process control device 20 (update device). Although details will be described later, the process control device 20 has a function for updating the program while the system is operating.

[0033] The process control device 10 has functions of hardware 11, a system function providing unit 12, and a control application 13. The hardware 11 includes a CPU (central processing unit), a memory, an input / output device, a communication device, etc., and executes various programs used in the process control device 10 (system programs that realize the system functions provided by the system function providing unit 12, application programs that realize the control application 13, etc.). The functions of the process control device 10 are realized by programs for realizing the functions being executed by the hardware 11. That is, the functions of the process control device 10 are realized by the cooperation of software and hardware resources.

[0034] The system function providing unit 12 is located between the hardware 11 and the control application 13, manages the hardware 11, and provides various system functions in response to calls from the control application 13. The system function providing unit 12 provides system functions such as, for example, a PID control function 12a, a sequence control function 12b, an interpreter function 12c, an I / O function 12d, a communication function 12e, etc. The system function providing unit 12 also includes an operating system (OS) and drivers. The system programs that implement the various system functions provided by the system function providing unit 12 include update target programs that can be updated and non-update target programs that are not update targets.

[0035] The control application 13 performs process control at a predefined control cycle (for example, a cycle of about several seconds). The control application 13 includes, for example, one or more control logics created by the user using the engine device 30. The control application 13 performs process control while calling the system functions provided by the system function providing unit 12. The switching from the process control device 10 to the process control device 20 is performed so that the processing of the control application 13 and the processing of the system functions called from the control application 13 continue.

[0036] The process control device 20 has the functions of the hardware 21, the system function providing unit 22, the control application 23, and the online update control unit 24. The hardware 21 is the same as the above-mentioned hardware 11 and executes various programs used in the process control device 20 (system programs that implement the system functions provided by the system function providing unit 22, application programs that implement the control application 23, etc.). The functions of the process control device 20 are also realized by the cooperation of software and hardware resources.

[0037] The system function providing unit 22 provides the same system functions as the above-described system function providing unit 12. Specifically, the system function providing unit 22 provides system functions such as a PID control function 22a, a sequence control function 22b, an interpreter function 22c, an I / O function 22d, and a communication function 22e. The system functions provided by the system function providing unit 22 may be the same as those provided by the system function providing unit 12, or may include different ones (for example, those with enhanced functions).

[0038] The online update control unit 24 controls the online system update process of updating the system program while continuing the processing of the system functions realized by the system program. Specifically, when the switch from the process control device 10 to the process control device 20 is performed, the online update control unit 24 acquires the data (handover data DT) that needs to be handed over for the continuous system functions from the process control device 10 and restores it to the process control device 20. The online update control unit 24 determines the timing for performing the switch from the process control device 10 to the process control device 20. Details of the processing performed by the online update control unit 24 will be described later.

[0039] The engineer's device 30 performs various engineering in the process control system 1 using the plant design information including the design information of the process control system 1. When causing the process control device 10 to switch to the process control device 20, the engineer's device 30 issues a command to start the process control device 20. The engineer's device 30 is realized by a computer such as a personal computer or a workstation.

[0040] Figure 2 is a functional block diagram showing the functional configuration for realizing online system update in the first embodiment of the present invention. In Figure 2, the redundancy function 15 is a function provided on the active device side (the process control device 10 in Figure 1), and the redundancy function 25 is a function provided on the update device side (the process control device 20 in Figure 1). The online update control unit 24 is a function provided on the update device side (the process control device 20 in Figure 1).

[0041] The redundancy functions 15 and 25 are functions for controlling the control system and standby system process control devices having a redundant configuration, and can be used for a part of the online system update function in addition to the use for redundancy. In any case, it is a function realized through the interaction between the process control devices 10 and 20, and both devices operate in cooperation with each other. The redundancy function 15 includes a memory access unit 15a and a control right switching unit 15b, and the redundancy function 25 includes a memory access unit 25a and a control right switching unit 25b.

[0042] The memory access unit 15a and the memory access unit 25a communicate with each other in the redundancy function to copy all the memories of the control system device to the memory of the standby system device. On the other hand, in the online system update function, when switching from the process control device 10 to the process control device 20, they communicate with each other to copy the handover data DT (see Figure 1) that needs to be taken over to continue the system function. The control right switching unit 15b and the control right switching unit 25b communicate with each other in the redundancy function to exchange control signals (control rights) to switch the control right from the control system device to the standby system device. On the other hand, in the online system update function, they exchange control signals (control rights) to switch from the active control device 10 to the update device 20. The functions of the redundancy functions 15 and 25 are realized by the cooperation of software and hardware resources.

[0043] As shown in FIG. 2, the online update control unit 24 includes a communication management unit 24a, a data transfer unit 24b, a timing determination unit 24c, and a program restart unit 24d. The process control device 20 is connected to the engine device 30 via a network. The communication management unit 24a of the process control device 20 may communicate with the engine device 30 via the network.

[0044] The communication management unit 24a receives a command (start command) transmitted from the engine device 30 via the network. When the communication management unit 24a receives a start command from the engine device 30, it gives an instruction to the timing determination unit 24c to determine the timing (switching timing) for switching from the process control device 10 to the process control device 20.

[0045] When the switching timing is determined by the timing determination unit 24c, the data transfer unit 24b acquires the transfer data DT that needs to be transferred to continue the system function from the process control device 10 and restores it to the process control device 20. The data transfer unit 24b has a symbol table TB1 of the system function in the process control device 10, and acquires the transfer data DT from the process control device 10 with reference to this symbol table TB1.

[0046] The above symbol table TB1 is a table generated by compiling and linking a system program (source program) that realizes the system function in the process control device 10. By referring to this symbol table TB1, the address where the transfer data DT is stored in the process control device 10 can be obtained. The data transfer unit 24b accesses the address obtained by referring to the symbol table TB1 to acquire the transfer data DT.

[0047] The data transfer unit 24b restores the transfer data DT to the process control device 20 by acquiring the address where the transfer data DT should be stored in the process control device 20 and setting the acquired transfer data DT at that address. That is, when the switch from the process control device 10 to the process control device 20 is made, the data transfer unit 24b restores the context of the system function for which the processing is to be continued to the process control device 20.

[0048] Based on an instruction from the communication management unit 24a, the timing determination unit 24c determines the switching timing from the process control device 10 to the process control device 20. Specifically, after confirming that all of the system functions in the process control device 10 are in a state where the processing has been completed (hereinafter also referred to as the "completed state of the process control device 10"), the timing determination unit 24c determines the switching timing so that the switch from the process control device 10 to the process control device 20 is made.

[0049] This is to ensure that the switch from the process control device 10 to the process control device 20 is made reliably. For example, when the system function is a function that outputs a control signal, if the switch from the process control device 10 to the process control device 20 is made before the output process of the control signal is completed, some of the outputs will be lost. To prevent such a situation from occurring, after confirming that the process control device 10 is in the completed state, the timing determination unit 24c determines the switching timing so that the switch from the process control device 10 to the process control device 20 is made.

[0050] The timing at which the timing determination unit 24c checks the completion state of the process control device 10 is during the period from when the processing to be executed in a certain control cycle of the process control device 10 ends until the next control cycle starts, and is the timing a predetermined time before the start of the next control cycle. The above-mentioned predetermined time is the sum of the time required for the timing determination unit 24c to check the completion state of the process control device 10 and the time required for the data transfer unit 24b to acquire the transfer data DT from the process control device 10 and restore it to the process control device 20.

[0051] That is, the timing determination unit 24c checks the completion state of the process control device 10 at a timing when there is still the minimum necessary time left for the switch from the process control device 10 to the process control device 20 by the time the next control cycle starts. Checking the completion state of the process control device 10 at such a timing is to confirm whether the time required for the system function in the process control device 10 to finish processing remains within that process control cycle after the processing to be executed in a certain control cycle of the process control device 10 ends.

[0052] When the timing determination unit 24c can check the completion state of the process control device 10, it notifies the process control device 10 of the switching timing. When the timing determination unit 24c cannot check the completion state of the process control device 10, it aborts the online system update. This is to prevent the online system update from being performed in a state where there are system functions that have not finished processing.

[0053] After the timing determination unit 24c notifies the process control device 10 of the switching timing, the program restart unit 24d waits for a control signal (control right) to be transmitted from the process control device 10 via the redundancy functions 15, 25. When a control signal (control right) is transmitted from the process control device 10, the program restart unit 24d restarts the program that realizes the system function and operates the process control device 20 as the active device.

[0054] <Program Update Method> Figure 3 is a flowchart showing a program update method according to the first embodiment of the present invention. As a prerequisite for executing the processing of the flowchart shown in Figure 3, the process control device 10 (current device) is operating using the system program before the update. The process control device 20 (update device) is waiting in a state where the system program after the update is installed. The system program after the update is downloaded and installed from the engine device 30 when the process control device 20 (update device) is temporarily activated based on a designation from the engine device 30, for example.

[0055] All or only a part of the system programs in the process control device 20 (update device) may be updated. The operation of the flowchart shown in Figure 3 is started when a start command output from the engine device 30 is received by the communication management unit 24a of the process control device 20 (update device).

[0056] When the processing shown in Figure 3 is started, first, the waiting process control device 20 (update device) is activated (step S11). Next, the process of selecting data (context) necessary for the system function being executed in the process control device 10 (current device) to continue the processing is performed by the data transfer unit 24b of the process control device 20 (update device) (step S12). The data transfer unit 24b performs the process of selecting the above data by referring to, for example, the symbol table TB1 of the system function in the process control device 10.

[0057] Next, the process of determining the timing for switching from the process control device 10 (current device) to the process control device 20 (update device) is performed by the timing determination unit 24c of the process control device 20 (update device) (step S13: timing determination step). Figure 4 is a flowchart showing the details of the processing in step S13 in Figure 3.

[0058] When the process of step S13 starts, first, a process for determining whether it is the waiting time during a control cycle (that is, whether it is the period from the end of the process to be executed in a certain control cycle of the process control device 10 until the start of the next control cycle) is performed by the timing determination unit 24c (step S21). If the determination result in step S21 is "NO", the determination in step S21 is repeated. That is, in the process control device 10 (the current device), since a certain control cycle is in progress, a process of waiting until the end of that control cycle is performed.

[0059] On the other hand, if the determination result in step S21 is "YES", a process for determining whether it is the timing a predetermined time before the start of the next control cycle is performed by the timing determination unit 24c (step S22). The above-mentioned predetermined time is the sum of the time required for the timing determination unit 24c to confirm the completion state of the process control device 10 and the time required for the data transfer unit 24b to acquire the transfer data DT from the process control device 10 and restore it to the process control device 20.

[0060] If the determination result in step S22 is "NO", the process returns to step S21. On the other hand, if the determination result in step S22 is "YES", a process for determining whether the process control device 10 (the current device) is in a completed state is performed by the timing determination unit 24c (step S23). If the determination result in step S23 is "NO", a process for aborting the online system update is performed by the timing determination unit 24c. When this process is performed, the series of processes shown in Figure 3 ends. On the other hand, if the determination result in step S23 is "YES", it is regarded that the switching timing has arrived, and the process of step S13 shown in Figure 3 ends.

[0061] When the process of step S13 shown in FIG. 3 ends, the data transfer unit 24b is called from the timing determination unit 24c. The data transfer unit 24b performs a process of acquiring the transfer data DT from the process control device 10 (current device) and restoring it to the process control device 20 (updating device) (step S14: data transfer step). FIG. 5 is a flowchart showing the details of the process of step S14 in FIG. 3.

[0062] When the process of step S14 starts, first, the data transfer unit 24b refers to the symbol table TB1 and performs a process of acquiring the address where the transfer data DT is stored in the process control device 10 (current device) (step S31). For example, a process of acquiring all the addresses where all the transfer data DT is stored at once is performed. Next, the data transfer unit 24b uses the memory access units 15a and 25a to perform a process of acquiring the transfer data DT stored at the address acquired in step S31 from the process control device 10 (current device) (step S32).

[0063] Next, the data transfer unit 24b performs a process of acquiring the address where the transfer data DT should be stored in the process control device 20 (updating device) (step S33). Specifically, a process of acquiring the address of a variable used in the updated system program installed in the process control device 20 (updating device) is performed. Subsequently, the data transfer unit 24b performs a process of setting the transfer data DT acquired from the process control device 10 (current device) in step S32 to the address of the process control device 20 (updating device) acquired in step S33. By performing the above processes, the transfer data DT is restored to the process control device 20 (updating device).

[0064] When the above processing is completed, the timing determination unit 24c performs processing to notify the process control device 10 (the current device) of the switching timing (step S15). When this notification is made, the program restart unit 24d enters a waiting state waiting for a control signal (control authority) to be transmitted from the process control device 10 via the redundancy functions 15 and 25.

[0065] When the process control device 10 (the current device) receives the above switching timing notified by the timing determination unit 24c, it transmits a control signal (control authority) to the process control device 20 (the update device) via the redundancy functions 15 and 25, and then stops operating. When receiving the control signal (control authority) transmitted from the process control device 10, the program restart unit 24d performs processing to restart the program that realizes the system function and operate the process control device 20 as the current device (step S16).

[0066] As described above, in the present embodiment, when the process control device 20, which is the update device, is switched from the process control device 10, which is the current device, to the process control device 20, the process control device 20 acquires the handover data DT that needs to be taken over in order to continue the system function from the process control device 10, restores it to the process control device 20, and determines the timing for switching from the process control device 10 to the process control device 20. In this way, in the present embodiment, the extension function of the online update function required for expanding the online system update only needs to be incorporated into the process control device 20, which is the update device, and there is no need to incorporate it into the process control device 10, which is the current device. Therefore, it is possible to realize the function expansion of the online system update without stopping the process control system 1.

[0067] 〔Second Embodiment〕 〈Process Control System〉 FIG. 6 is a functional block diagram showing a functional configuration for realizing online system update in the second embodiment of the present invention. In FIG. 6, the same reference numerals are given to the configurations corresponding to those shown in FIG. 2. The functional configuration of the entire process control system according to this embodiment is the same as that described with reference to FIG. 1. Hereinafter, the description will focus on the differences from the above-described first embodiment.

[0068] In this embodiment, even if the value of the transfer data DT is the address value of a variable stored in the address variable area, the transfer of the transfer data DT is correctly performed. The address variable area is an area (storage area) in which the address may vary when switching from the process control device 10 (current device) to the process control device 20 (update device). This address variable area consists of one or more areas where the addresses are continuous, and each area is managed by a start address and a size.

[0069] Even if the address value of a variable stored in such an address variable area is transferred, if the start address of the address variable area changes, the transferred address value becomes meaningless. In this embodiment, even if the start address of the address variable area changes, the transfer of the transfer data DT is correctly performed.

[0070] As shown in FIG. 6, the online update control unit 24A in this embodiment has a configuration in which an address conversion unit 24e is added to the online update control unit 24 shown in FIG. 2. The redundancy functions 15 and 25 are the same as those shown in FIG. 2. The address conversion unit 24e is called from the data transfer unit 24b when the value of the transfer data DT is the address value of a variable stored in the address variable area, and performs conversion of the address value using the address conversion table TB2. The address conversion unit 24e does not perform conversion using the address conversion table TB2 when the value of the transfer data DT is not the address value of a variable stored in the address variable area.

[0071] The address conversion table TB2 is a table in which, for all variables stored in the address variable area, the storage address before the switching is associated with the storage address after the switching. This address conversion table TB2 is prepared for each area where the addresses of the address variable area are continuous (that is, for each area managed by the start address and the size).

[0072] This address conversion table TB2 utilizes the property that the offset of the storage address of each variable (the offset from the start address of the address variable area) does not change before and after the switching without modifying the program related to the address variable area. The address conversion table TB2 is created in advance, for example, using a symbol table generated by compiling and linking a system program (source program) that realizes the system functions in the process control devices 10, 20.

[0073] FIG. 7(a) and FIG. 7(b) are diagrams showing an example of the address conversion table in the second embodiment of the present invention. The address conversion table TB2 shown in FIG. 7(a) is for the case where the external variables shown in FIG. 7(b) are declared in a system program (source program) that realizes the system functions in the process control device 10. In the present embodiment, for ease of understanding, it is described assuming that the above source program is written in the C language, but the above source program may be written in any language other than the C language.

[0074] In the example shown in FIG. 7(b), integer variable a, structure variable b having member integer variables b1 and b2, array variable c having six integer elements, pointer *p_a to variable a, pointer *p_b to member b2 of structure variable b, and pointer *p_c to the second element (c[2]) of array variable c are declared as external variables. When such declarations are made, as shown in FIG. 7(a), variable a, structure variable b, member b1 of structure variable b, member b2 of structure variable b, array variable c, the 0th to 5th elements c[0] to c[5] of the array variable, pointer variable p_a, pointer variable p_b, and pointer variable p_c are continuously stored in the address variation area in this order. The size of each variable is 32 bits (4 bytes).

[0075] Assuming that the start address of the address variation area before switching where these external variables are stored is "0xa000" in hexadecimal notation, the addresses where each external variable is stored will be as shown as the "address before switching" in FIG. 7(a). Assuming that the start address of the address variation area after switching where these external variables are stored is 0xc000 in hexadecimal notation, the addresses where each external variable is stored will be as shown as the "address after switching" in FIG. 7(a). The size of the address variation area where the external variables are stored is 48 bytes and does not change before and after the switching.

[0076] 〈Program Update Method〉 The program update method of this embodiment is the same as the program update method of the first embodiment. Basically, the system program is updated by executing the steps shown in FIGS. 3 to 5. However, in this embodiment, when the process of acquiring and restoring the inheritance data DT from the current device (the process of step S14 shown in FIG. 3) is performed in the data inheritance unit 24b, the conversion process using the address conversion table TB2 is performed by the address conversion unit 24e.

[0077] FIG. 8 is a flowchart showing the address conversion process performed in the second embodiment of the present invention. The process of the flowchart shown in FIG. 8 may be performed, for example, in step S32 or step S34 in FIG. 5 that shows the process of step S14 shown in FIG. 3 in detail. When the process starts, first, the data transfer unit 24b determines whether the value of the variable to be transferred is an address value within the address variation area (step S41).

[0078] If the determination result in step S41 is "YES", the data transfer unit 24b performs a process of extracting the address value before switching stored in the variable to be transferred (step S42). Next, the address conversion unit 24e is called by the data transfer unit 24b, and the address conversion unit 24e performs a process of obtaining the address after switching corresponding to the address value before switching with reference to the address conversion table TB2 (step S43). Subsequently, the address conversion unit 24e performs a process of setting the obtained address value to the variable to be transferred (step S44).

[0079] When the process of step S44 ends, or when the determination result in step S41 is "NO", the data transfer unit 24b determines whether the above process has ended for all of the transfer data DT (step S45). If the determination result in step S45 is "NO", the process returns to step S41, and the same process is performed for the remaining variables. On the other hand, if the determination result in step S45 is "YES", the series of processes shown in FIG. 8 ends.

[0080] When the above processing is performed when the external variables shown in Fig. 7(b) are declared, the address values stored in the pointer variable p_a, the pointer variable p_b, and the pointer variable p_c illustrated in Fig. 7(b) are converted. Specifically, the address value "0xa000" stored in the pointer variable p_a is converted to the address value "0xc000", the address value "0xa008" stored in the pointer variable p_b is converted to the address value "0xc008", and the address value "0xa014" stored in the pointer variable p_c is converted to the address value "0xc014". On the other hand, for the remaining variables (variable a, structure variable b, member b1 of structure variable b, member b2 of structure variable b, array variable c, elements c[0] to c[5] of the 0th to 5th of the array variable), the values are carried over as they are.

[0081] As described above, in this embodiment, when the inherited data DT is the address value of a variable stored in an address variable region where the address may vary before and after the switching, the address conversion table TB2 is used to convert the address value. Therefore, even if the start address of the address variable region changes before and after the switching, the inheritance of the inherited data DT (the address value of the variable stored in the address variable region) can be correctly performed.

[0082] In this embodiment, when modifying the variables assigned to the address variable region, it can be easily handled by only modifying the address conversion table TB2. Specifically, when adding or deleting variables in the address variable region, the offset of the variable may be modified accordingly.

[0083] Figs. 9(a) and 9(b) are diagrams showing an example of a modified address translation table in the second embodiment of the present invention. Now, assume that the external variables (variables assigned to the address variable region) shown in Fig. 7(b) are modified as shown in Fig. 9(b). Specifically, assume that a structure variable b having integer variables b1 and b2 as members is modified to a structure variable b having integer variables b1, b2, b3, and b4 as members, and an array variable c having six integer elements is modified to an array variable c having four integer elements.

[0084] When such a modification is made, the address translation table TB2 shown in Fig. 7(a) may be modified to the address translation table TB2 shown in Fig. 9(a). That is, for the members b3 and b4 of the added structure variable b, assume that there is no address before the switch, and for the elements (the fourth and fifth elements) of the deleted array variable c, it may be modified to assume that there is no address after the switch.

[0085] In the above embodiment, the address conversion unit 24e uses the address conversion table TB2 to perform conversion of the address value to be carried over (the address value of the variable stored in the address variable region). However, if the storage address of each variable assigned to the address variable region does not change in terms of the offset address value from the start of the region before and after the switch, that is, if there is no addition or deletion modification to the variables assigned to the address variable region, the address conversion unit 24e may perform conversion of the address value to be carried over using the address conversion formula shown in the following formula (1) without using the address conversion table TB2.

[0086] D = C+(B - A) …(1) A: Start address of the address variable region before the switch B: Start address of the address variable region after the switch C: Address value before the switch D: Address value after the switch

[0087] 〔Third Embodiment〕 〈Process Control System〉 FIG. 10 is a functional block diagram showing a functional configuration for realizing online system update in the third embodiment of the present invention. In FIG. 10, the same reference numerals are given to the configurations corresponding to those shown in FIGS. 2 and 6. The functional configuration of the entire process control system according to the present embodiment is the same as that described with reference to FIG. 1. Hereinafter, the description will be centered on the differences from the above-described first and second embodiments.

[0088] In this embodiment, even when the cache is enabled in the process control device 10 (current device), the transfer of the transfer data DT is correctly performed. The cache of the process control device 10 (current device) is a temporary storage area for data provided between the CPU and the memory provided in the process control device 10 (current device). Since the cache cannot be referred to from the process control device 20 (updating device), it can also be said that the data is temporarily held in a state where it cannot be referred to from the process control device 20 (updating device).

[0089] When such a cache is provided, the contents of the data stored in the cache may be different from the data stored in the memory. Since the process control device 20 (updating device) accesses the memory of the process control device 10 (current device) to acquire the transfer data DT, if the data stored in the memory is different from the data stored in the cache, the transfer of the transfer data DT is not correctly performed. In this embodiment, the transfer of the transfer data DT is correctly performed by operating the cache of the process control device 10 (current device) from the process control device 20 (updating device).

[0090] As shown in FIG. 10, in this embodiment, an online update control unit 14 is provided on the current device side (the process control device 10 in FIG. 1). An online update control unit 24B is provided on the updating device side (the process control device 20 in FIG. 1). The redundancy functions 15 and 25 are the same as those shown in FIGS. 2 and 6.

[0091] The online update control unit 14, together with the online update control unit 24B, controls the online system update process of updating the system program while continuing the processing of the system functions realized by the system program. The online update control unit 14 includes a cache operation unit 14a that operates on the cache of the process control device 10 (the current device). In this embodiment, it is necessary to pre-incorporate the online update control unit 14 including the cache operation unit 14a into the process control device 10 (the current device) in advance.

[0092] Specifically, the cache operation unit 14a operates on the cache according to the following three types of cache operation flags. · Flash flag... A flag that controls whether to reflect the content of the cache in the memory. If the value is "1", the content of the cache is reflected in the memory by the cache operation unit 14a. When the content of the cache is reflected in the memory, the value is set to "0" by the cache operation unit 14a. · Invalidation flag... A flag that invalidates the cache. If the value is "1", the cache is invalidated by the cache operation unit 14a. · Validation flag... A flag that validates the cache. If the value is "1", the cache is validated by the cache operation unit 14a.

[0093] The online update control unit 24B has a configuration in which the timing determination unit 24c of the online update control unit 24A shown in FIG. 6 is replaced with a timing determination unit 24f. The timing determination unit 24f operates on the cache of the process control device 10 (the current device) by changing the value of the cache operation flag used in the cache operation unit 14a of the process control device 10 (the current device).

[0094] The timing determination unit 24f sets the value of the flash flag to "1" immediately before determining the switching timing when, for example, the processing to be executed in a certain control cycle is completed. The timing determination unit 24f sets the value of the flash flag to "1" immediately after the completion of the processing of each system function being executed by the process control device 10 (active device). Alternatively, the timing determination unit 24f sets the value of the invalidation flag to "1" during an arbitrary period (for example, the period during which the online system update is performed).

[0095] 〈Program update method〉 The program update method of this embodiment is the same as the program update method of the second embodiment. Basically, the system program is updated by executing the steps shown in FIGS. 3 to 5 and FIG. 8. However, in this embodiment, an operation is performed in which the timing determination unit 24f of the process control device 20 (updating device) sets the value of the flash flag to "1" between step S22 and step S23 shown in FIG. 4.

[0096] When the value of the flash flag is set to "1", an operation is performed to reflect the contents of the cache in the memory by the cache operation unit 14a of the process control device 10 (active device). By reflecting the contents of the cache in the memory, the process control device 20 (updating device) can refer to the contents. Therefore, it can also be said that the operation of reflecting the contents of the cache performed by the cache operation unit 14a is an operation that makes the data held in the cache referable by the process control device 20 (updating device).

[0097] As described above, in this embodiment, the timing determination unit 24f of the process control device 20 (updating device) operates the value of the cache operation flag to perform an operation of reflecting the contents of the cache in the memory by the cache operation unit 14a of the process control device 10 (active device). Therefore, even when the cache is valid in the process control device 10 (active device), the inheritance of the inheritance data DT can be correctly performed.

[0098] As described above, by using any of the foregoing embodiments, it is possible to realize online system update (updating the system program while continuing the processing of functions (system functions) realized by the system program) without stopping the process control system.

[0099] At least some functions of the process control devices 10 and 20 and the engine equipment 30 in each embodiment can be realized by a computer. In that case, a program for realizing this function may be recorded on a computer-readable recording medium, and the program recorded on this recording medium may be read into a computer system and executed to realize it.

[0100] The above-mentioned "computer system" shall include hardware such as an OS and peripheral devices. The "computer-readable recording medium" refers to a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, a DVD-ROM, a USB memory, etc., and a storage device such as a hard disk built into a computer system. Further, the "computer-readable recording medium" refers to something that temporarily and dynamically holds a program, such as a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line, and also includes something that holds a program for a certain period of time, such as a volatile memory inside a computer system that serves as a server or a client in that case. The above program may realize a part of the foregoing functions, and may also be realized in combination with a program already recorded in the computer system for the foregoing functions.

[0101] The process control system, process control apparatus, and program update method according to the embodiments of the present invention have been described above. The present invention is not limited to the above-described embodiments, and can be arbitrarily changed within the scope of the present invention. For example, the first embodiment and the third embodiment may be combined. In the above-described embodiments, they have been described as configurations of the process control system and the process control apparatus. However, the configurations provided in these embodiments can also be applied to any other system. In the above-described embodiments, the operating system may be an embedded OS for controlling an embedded system, or a general-purpose OS for controlling a general-purpose computer.

Explanation of Signs

[0102] 1 Process control system 10 Process control apparatus 14a Cache operation unit 20 Process control apparatus 24b Data transfer unit 24c Timing determination unit 24e Address conversion unit 24f Timing determination unit DT Transfer data TB1 Symbol table TB2 Address conversion table

Claims

1. A process control system comprising a first process control device and a second process control device, wherein the second process control device has a data transfer unit that acquires transfer data, which is data that needs to be transferred in order to continue system functions when switching from the first process control device to the second process control device, from the first process control device and restores it to the second process control device; and a timing determination unit that determines the timing of the switching so that the switching is performed after confirming that all of the system functions in the first process control device are in a completed state. A process control system comprising the above.

2. The process control system according to claim 1, wherein the data transfer unit acquires the transfer data from the first process control device by referring to a symbol table of the system functions in the first process control device.

3. The process control system according to claim 1 or 2, wherein the timing determination unit aborts the switching when the completed state cannot be confirmed.

4. When the transfer data is the address value of a variable stored in an address variable region where the address may change, before the switching is performed, using an address conversion table in which the address of the variable stored in the address variable region and the address of the variable stored in the address variable region after the switching are associated with each other, the process control system according to any one of claims 1 to 3 further comprising an address conversion unit that converts the address value as the transfer data.

5. The process control system according to claim 4, wherein the address conversion table is generated in advance using a symbol table of the system functions in the first process control device and a symbol table of the system functions in the second process control device.

6. The first process control device includes a cache operation unit that operates a cache that temporarily holds data used internally in a state where the data cannot be referred to from the second process control device, and when determining the timing, the timing determination unit performs an operation on the cache operation unit to make the data held by the cache referable from the second process control device. The process control system according to any one of claims 1 to 5.

7. The process control system according to claim 6, wherein the timing determination unit is capable of performing an operation of enabling or disabling the cache on the first process control device.

8. The process control system according to claim 2, wherein the symbol table is a table generated by compiling and linking a system program that realizes a system function in the first process control device.

9. The process control system according to claim 2, wherein the data transfer unit obtains an address where the transfer data is stored in the first process control device by referring to the symbol table.

10. The process control system according to claim 1, wherein the timing is between when the processing to be executed in a certain control cycle of the first process control device ends and when the next control cycle starts, and is a timing a predetermined time before the start of the next control cycle.

11. The process control system according to claim 10, wherein the predetermined time is the time required for the timing determination unit to confirm the completion state of the first process control device plus the time required for the data transfer unit to obtain the transfer data from the first process control device and restore it to the second process control device.

12. The process control system according to claim 4, wherein the address change area consists of one or more areas where the addresses are continuous, and each area is managed by a start address and a size.

13. A process control device for which switching from another device to its own device is performed, A data transfer unit that obtains transfer data, which is data that needs to be transferred to continue the system function when the switching is performed, from another device and restores it to its own device, A timing determination unit that determines the timing of the switching so that the switching is performed after confirming that all of the system functions in the other device are in a completed state where the processing has ended, A process control device comprising the above.

14. A program update method in a process control system including a first process control device and a second process control device, The second process control device acquires handover data, which is data that needs to be taken over in order to continue the system function when the switching from the first process control device to the second process control device is performed, from the first process control device and restores it to the second process control device. The second process control device determines the timing of the switching so that the switching is performed after confirming that all of the system functions in the first process control device are in a completed state where the processing has been finished. Program update method.

Images