Management system for industrial controller control programs

Abstract

To provide a management system for a control program of an industrial controller in which redundancy can be achieved by two server devices.SOLUTION: The management system includes a first server device and a second server device. In normal operation, the first server device is in a master state and the second server device is in a backup state. The second server device is a member of a first group that receives data transmitted from the first server device. The first server device transmits a first healthy signal to the first group at regular intervals. The second server device switches from the backup state to the master state on the basis of the first healthy signal transmitted from the first server device to the first group.SELECTED DRAWING: Figure 5

Description

Technical Field

[0002] , , , , , , ,

[0004] , ,

[0006] , , , , , , , ,

[0005] , , ,

[0003] , , , , , ,

[0001] This embodiment relates to a management system for a control program of an industrial controller.

Background Art

[0002] The control system of an industrial plant includes a management system for managing the control program of an industrial controller. The management system is composed of a server device and a plurality of client devices. In a large-scale industrial plant, the number of client devices can range from dozens to hundreds.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the management system as described above, there is a requirement to make the server device redundant. However, in a general redundancy technique, for example, if two server devices are used, another one server device is required to control the two server devices, resulting in a total of three server devices being required.

[0005] This embodiment is for solving the above problems, and an object thereof is to provide a management system for a control program of an industrial controller that can achieve redundancy with two server devices.

Means for Solving the Problems

[0006] [[ID=K45]] To solve the above problems, the control program management system for an industrial controller according to this embodiment comprises a first server device including a first processing unit and a first database in which the control program is registered, and a second server device including a second processing unit and a second database in which the program is registered. During normal operation, the first processing unit of the first server device is in a master state, the second processing unit of the second server device is in a backup state, and the second server device is a member of a first group that receives data transmitted from the first server device. The first processing unit of the first server device transmits a first healthy signal to the first group at regular intervals, and the second processing unit of the second server device switches from the backup state to the master state based on the first healthy signal transmitted from the first server device to the first group. [Brief explanation of the drawing]

[0007] [Figure 1] A diagram showing the configuration of the control system for an industrial plant according to Embodiment 1. [Figure 2] A diagram showing the configuration of the first server device. [Figure 3] A diagram showing the configuration of the second server unit. [Figure 4] A diagram showing the configuration of the client device. [Figure 5] A diagram illustrating the normal operation of the management system. [Figure 6A] A diagram illustrating the operation of the first server device when an abnormality occurs. [Figure 6B] A diagram illustrating the operation of the first server device when an abnormality occurs. [Figure 6C] A diagram illustrating the operation of the first server device when an abnormality occurs. [Figure 6D] A diagram illustrating the operation of the first server device when an abnormality occurs. [Figure 7A] A diagram illustrating the operation of the first server device during a communication failure. [Figure 7B] A diagram illustrating the operation of the first server device during a communication failure. [Figure 7C]A diagram illustrating the operation of the first server device during a communication failure. [Figure 7D] A diagram illustrating the operation of the first server device during a communication failure. [Figure 8A] A diagram illustrating the operation of the second server device during a communication failure. [Figure 8B] A diagram illustrating the operation of the second server device during a communication failure. [Figure 9A] This diagram illustrates the operation when both server devices are in master mode. [Figure 9B] This diagram illustrates the operation when both server devices are in master mode. [Figure 9C] This diagram illustrates the operation when both server devices are in master mode. [Figure 9D] This diagram illustrates the operation when both server devices are in master mode. [Modes for carrying out the invention]

[0008] This embodiment will be described below with reference to the drawings. The following description will be based on an example of using the control system according to this embodiment for the control of an industrial plant. However, the applicable scope of the control system according to this embodiment is not limited to the control of industrial plants. Furthermore, the same reference numerals are used for identical or corresponding elements in the drawings, and detailed explanations are omitted as appropriate.

[0009] (Embodiment 1) FIG. 1 is a diagram showing the configuration of a control system 1 of an industrial plant according to Embodiment 1. The control system 1 includes a management system 100 that manages a control program of an industrial controller. The management system 100 includes a first server device 10, a second server device 20, and one or more client devices 30. The management system 100 has a redundant configuration. During normal operation, the first server device 10 is in a master state, that is, an operating state, and the second server device 20 is in a backup state, that is, a standby state. The first server device 10, the second server device 20, and the client devices 30 are connected to a control network 61.

[0010] One or more industrial controllers 40 are connected to the control network 61. The industrial controller 40 is connected to a field network 62. One or more field devices 50 are connected to the field network 62. Note that the specific implementation methods of the control network 61 and the field network 62 are not particularly limited. As an example, the control network 61 and the field network 62 are Ethernet (registered trademark). Also, the control network 61 may be duplicated.

[0011] FIG. 2 is a diagram showing the configuration of the first server device 10. The first server device 10 includes a first processing unit 11, a first storage unit 12, and a first database 13. The first processing unit 11 controls the operation of the first server device 10. An area for a first healthy counter 12a is secured in the first storage unit 12. A control program of the industrial controller 40 is registered in the first database 13.

[0012] The first server device 10 manages a first group to which the second server device 20 and one or more client devices 30 can belong. By transmitting data to the first group, the first server device 10 can batch-transmit the same data to the second server device 20 and the one or more client devices 30 belonging to the first group. Such a mechanism can be realized, for example, by multicast communication of UDP (User Datagram Protocol).

[0013] The first health counter 12a is incremented or decremented at a predetermined period, for example, at a period of 1 second, while the first server device 10 is functioning normally. Such a mechanism can be realized, for example, by generating an interrupt at a predetermined period and incrementing or decrementing the value of a counter variable.

[0014] The specific implementation method of the first server device 10 is not particularly limited. As an example, the first server device 10 is a personal computer. In this case, the first processing unit 11 is a CPU (Central Processing Unit), and the first storage unit 12 is a RAM (Random Access Memory) and a ROM (Read Only Memory). Also, the first database 13 is realized by an application program executed by the CPU and a table constructed in an auxiliary storage device such as an HDD (Hard Disk Drive).

[0015] FIG. 3 is a diagram showing the configuration of the second server device 20. The second server device 20 includes a second processing unit 21, a second storage unit 22, and a second database 23. The second processing unit 21 controls the operation of the second server device 20. An area for the second health counter 22a is secured in the second storage unit 22. A control program for the industrial controller 40 is registered in the second database 23.

[0016] The second server device 20 can create a second group to which one or more client devices 30 can join. By sending data to the second group, the second server device 20 can send the same data in bulk to one or more client devices 30 that are members of the second group. Such a mechanism can be implemented, for example, by UDP multicast communication.

[0017] The specific implementation method of the second server device 20 is not particularly limited, but as an example, the second server device 20 is a personal computer. In this case, the second processing unit 21 is a CPU, and the second storage unit 22 is RAM and RAM. The second database 23 is implemented by an application program executed by the CPU and tables constructed in an auxiliary storage device such as an HDD.

[0018] Figure 4 shows the configuration of the client device 30. The client device 30 comprises a third processing unit 31, a third storage unit 32, a display unit 33, and an input unit 34. The client device 30 can access the database of the server device that manages the group to which it belongs. For example, if the client device 30 belongs to the first group managed by the first server device 10, the client device 30 can access the first database 13 of the first server device 10. Also, if the client device 30 belongs to the second group managed by the second server device 20, the client device 30 can access the second database 23 of the second server device 20.

[0019] The user can utilize the functions provided by the first server device 10 or the second server device 20 via the client device 30. Specifically, by operating the client device 30, the user can create, edit, add, delete, etc., control programs executed by the industrial controller 40. The user can also register the created control programs in the first database 13 or the second database 23 by operating the client device 30. Furthermore, the user can send the control programs registered in the first database 13 or the second database 23 to the industrial controller 40 for execution by operating the client device 30.

[0020] The specific implementation method of the client device 30 is not particularly limited, but as an example, the client device 30 is a personal computer. In this case, the third processing unit 31 is a CPU, and the third storage unit 32 is RAM and ROM. The display unit 33 is, for example, a liquid crystal display, and the input unit 34 is, for example, a keyboard and mouse.

[0021] Returning to Figure 1, the industrial controller 40 is a DCS (Distributed Control System) or PLC (Programmable Logic Controller), etc. The industrial controller 40 collects the status of the industrial plant based on signals received via field devices 50 and a field network 62 from sensors (not shown) attached to the controlled object.

[0022] The industrial controller 40 performs various calculations based on the collected plant status, and controls the industrial plant by operating actuators (not shown) attached to the controlled object via the field network 62 and field devices 50 based on the calculation results.

[0023] The field device 50 is a device for inputting and outputting signals to and from various devices attached to the controlled object. The field device 50 includes AI (Analog Input) devices or DI (Digital Input) devices that receive signals from sensors and the like attached to the controlled object. The field device 50 also includes AO (Analog Output) devices or DO (Digital Output) devices that output signals to actuators and the like attached to the controlled object.

[0024] Next, the operation of the management system 100 according to this embodiment 1 will be described. In the following description, it will be assumed that there are two client devices 30a and 30b. When it is not necessary to distinguish between the two client devices 30a and 30b, they will be referred to collectively as client device 30. Furthermore, the control network 61 is duplicated by control networks 61a and 61b.

[0025] (Normal operation) Figure 5 illustrates the normal operation of the management system 100. During normal operation of the management system 100, the first server device 10 is in master mode, and the second server device 20 is in backup mode. The second server device 20 is a member of the first group managed by the first server device 10, which is in master mode, and can receive data sent from the first server device 10 to the first group.

[0026] The first database 13 of the first server device 10 and the second database 23 of the second server device 20 are equalized at a predetermined interval, for example, every 30 seconds. The method of equalization is not particularly limited, but as an example, the first server device 10 creates first history information when the first database 13 is updated, and the second server device 20 performs equalization from the first database 13 to the second database 23 based on the first history information.

[0027] The two client devices 30a and 30b are members of a first group managed by the first server device 10, which is in master mode, and can receive data sent from the first server device 10 to the first group. In addition, the client devices 30a and 30b can access the first database 13 of the first server device 10.

[0028] , The first server device 10 sends data containing the count value of its first healthy counter 12a (first healthy signal) to the first group at regular intervals, for example, every 3 seconds. This data also includes the machine name, IP address, and port number of the second server device 20, which is in backup mode.

[0029] The second server device 20 receives data transmitted from the first server device 10 to the first group at regular intervals, and determines whether the first server device 10 is operating normally based on the value of the first healthy signal contained in the data. Specifically, the second server device 20 determines that the first server device 10 is operating normally if the value of the first healthy signal received from the first server device 10 changes over a predetermined period, for example, 10 seconds.

[0030] Client devices 30a and 30b receive data that is sent from the first server device 10 to the first group at regular intervals, and determine whether the first server device 10 is operating normally based on the value of the first healthy signal contained in the data. Specifically, if the value of the first healthy signal received from the first server device 10 changes over a predetermined period, for example, 10 seconds, client devices 30a and 30b determine that the first server device 10 is operating normally.

[0031] (When a malfunction occurs in the first server device) Figures 6A to 6D illustrate the operation of the first server device 10 when an abnormality occurs. Specifically, an abnormality in the first server device 10 includes the shutdown of the first server device 10, the failure of applications running on the first server device 10, an abnormality in the first database 13, and the failure of the operating system running on the first server device 10.

[0032] In Figure 6A, when an abnormality occurs in the first server device 10, the value of the first healthy signal included in the data transmitted from the first server device 10 to the first group at regular intervals stops changing. The second server device 20, detecting this, determines that the first server device 10 is not operating normally and switches from backup state to master state. The second server device 20, having switched to master state, leaves the first group and creates the second group.

[0033] In Figure 6B, when client devices 30a and 30b detect that the value of the first healthy signal included in the data transmitted periodically from the first server device 10 to the first group has stopped changing, they determine that the first server device 10 is not functioning properly, leave the first group managed by the first server device 10, and join the second group created by the second server device 20. As a result, client devices 30a and 30b can access the second database 23 of the second server device 20.

[0034] In Figure 6C, the second server device 20 transmits data containing the count value of its second healthy counter 22a (second healthy signal) to the second group at regular intervals, for example, every 3 seconds. During this time, client devices 30a and 30b can continue to access the second database 23 of the second server device 20.

[0035] In Figure 6D, when the first server device 10 recovers, it enters a backup state and joins the second group. At this time, an equalization process is performed from the second database 23 to the first database 13. Client devices 30a and 30b can continue to access the second database 23 of the second server device 20.

[0036] (In the event of a communication failure in the first server device) Figures 7A to 7D illustrate the operation of the first server device 10 during a communication failure. Specifically, the communication failure of the first server device 10 refers to a communication failure between the first server device 10 and the redundant control networks 61a and 61b.

[0037] In Figure 7A, if a communication failure occurs between the first server device 10 and the control networks 61a and 61b, data including the first healthy signal, which is transmitted from the first server device 10 to the first group at regular intervals, will not reach the second server device 20. Detecting this, the second server device 20 determines that a communication failure has occurred in the first server device 10 and switches from backup to master mode. Having switched to master mode, the second server device 20 leaves the first group and creates a second group.

[0038] In Figure 7B, when client devices 30a and 30b stop receiving data containing the first healthy signal, which is transmitted periodically from the first server device 10 to the first group, they determine that a communication failure has occurred in the first server device 10, leave the first group managed by the first server device 10, and join the second group created by the second server device 20.

[0039] In Figure 7C, the second server device 20 transmits data containing the count value of its second healthy counter 22a (second healthy signal) to the second group at regular intervals, for example, every 3 seconds. When client devices 30a and 30b confirm receipt of the data containing the second healthy signal transmitted from the second server device 20 to the second group, they become able to access the second database 23 of the second server device 20.

[0040] In Figure 7D, when the communication failure between the first server device 10 and the control networks 61a and 61b is resolved, the first server device 10 enters a backup state and joins the second group. At this time, an equalization process is performed from the second database 23 to the first database 13. Client devices 30a and 30b can continue to access the second database 23 of the second server device 20.

[0041] (In the event of a communication failure in the second server device) Figures 8A and 8B illustrate the operation of the second server device 20 during a communication failure. Specifically, the communication failure of the second server device 20 refers to a communication failure between the second server device 20 and the redundant control networks 61a and 61b.

[0042] In Figure 8A, if a communication failure occurs between the second server device 20 and the control networks 61a and 61b, data including the first healthy signal, which is transmitted from the first server device 10 to the first group at regular intervals, will no longer reach the second server device 20. Detecting this, the second server device 20 mistakenly determines that a communication failure has occurred in the first server device 10 and switches from backup to master mode. Having switched to master mode, the second server device 20 leaves the first group and creates a second group.

[0043] However, since no communication failure actually occurs in the first server device 10, client devices 30a and 30b can receive data including the first healthy signal that is transmitted periodically from the first server device 10 to the first group. Therefore, client devices 30a and 30b can continue to access the first database 13 of the first server device 10.

[0044] In Figure 8B, when the communication failure between the second server device 20 and the control networks 61a and 61b is resolved, the second server device 20 returns to the backup state and joins the first group. At this time, an equalization process is performed from the first database 13 to the second database 23. Client devices 30a and 30b can continue to access the first database 13 of the first server device 10.

[0045] (When both server devices are in master mode) Figures 9A and 9B illustrate the operation when both the first server device 10 and the second server device 20 are in master mode. This state can occur when a communication failure occurs between the first server device 10 and the control network 61b, and also when a communication failure occurs between the second server device 20 and the control network 61a.

[0046] In Figure 9A, data containing the first healthy signal, which is transmitted periodically from the first server device 10 to the first group, stops reaching the second server device 20. Detecting this, the second server device 20 switches from backup mode to master mode. Having switched to master mode, the second server device 20 leaves the first group and creates a second group.

[0047] In Figure 9B, when client device 30b stops receiving data containing the first healthy signal, which is sent periodically from the first server device 10 to the first group, it leaves the first group managed by the first server device 10 and joins the second group created by the second server device 20. As a result, client device 30b begins to access the second database 23 of the second server device 20.

[0048] On the other hand, client device 30a can receive data containing the first healthy signal, which is transmitted periodically from the first server device 10 to the first group, and therefore remains in the first group managed by the first server device 10. Consequently, client device 30a continues to access the first database 13 of the first server device 10. As this situation continues, the contents of the first database 13 and the contents of the second database 23 diverge.

[0049] In Figure 9C, once all communication failures in control networks 61a and 61b are resolved, the first server device 10 maintains the master state and continues to transmit data including the first healthy signal. Meanwhile, when the second server device 20 receives data including the first healthy signal transmitted from the first server device 10, it switches from the master state to the backup state, rejoins the first group, and stops transmitting data including the second healthy signal.

[0050] In Figure 9D, client device 30a remains in the first group and continues to access the first database 13 of the first server device 10. On the other hand, when client device 30b stops receiving data containing the second healthy signal transmitted from the second server device 20, it leaves the second group and rejoins the first group. As a result, client device 30b can once again access the first database 13 of the first server device 10. At this time, the first database 13 and the second database 23 are equalized.

[0051] As described above, in the management system 100 according to this embodiment 1, during normal operation, the first server device 10 is in master mode and the second server device 20 is in backup mode. Furthermore, the second server device 20 is a member of the first group that receives data transmitted from the first server device 10.

[0052] The first server device 10 transmits a first healthy signal to the first group at regular intervals, and the second server device 20 switches from backup state to master state based on the first healthy signal transmitted from the first server device 10 to the first group.

[0053] Due to the above features, the management system 100 according to this embodiment 1 can achieve redundancy with two server devices. As a result, the number of server devices required is reduced from three to two, leading to a significant cost reduction. Furthermore, since the switching from the backup state to the master state of the second server device 20 is performed automatically, the effort required for the user to perform the switch is eliminated.

[0054] Furthermore, during normal operation, the client device 30 is a member of the first group managed by the first server device 10. Based on the first healthy signal sent from the first server device 10 to the first group, the client device 30 leaves the first group and joins the second group created by the second server device 20. As a result, when the second server device 20 switches to master mode, the client device 30 automatically connects to the second server device 20. Therefore, the user is not required to perform the switch manually.

[0055] Furthermore, when the client device 30 is a member of the first group, it accesses the first database 13 of the first server device 10, and when it is a member of the second group, it accesses the second database 23 of the second server device 20. This allows the client device 30 to always access the database of the server device in master mode.

[0056] The first server device 10 creates a first update history when the first database 13 is updated, and the second server device 20 performs equalization from the first database 13 to the second database 23 based on the first update history. The second server device creates a second update history when the second database is updated, and the first server device 10 performs equalization from the second database 23 to the first database 13 based on the second update history. This ensures that the contents of the first database 13 and the second database 23 are always kept identical.

[0057] While several embodiments have been described, these embodiments are presented as examples and are not intended to limit the scope of the embodiments. These embodiments can be implemented in various other forms, and various omissions, substitutions, modifications, and combinations are possible without departing from the spirit of the embodiments. These embodiments and their variations are included in the scope and spirit of the embodiments, as well as in the claims and their equivalents.

[0058] Furthermore, this embodiment can also be configured as follows. [Item 1] (First server device, second server device) A control system for industrial controllers, A first server device including a first processing unit and a first database in which the control program is registered, A second server device including a second processing unit and a second database in which the control program is registered. Equipped with, During normal operation, the first processing unit of the first server device is in master mode, the second processing unit of the second server device is in backup mode, and the second server device is a member of the first group that receives data transmitted from the first server device. The first processing unit of the first server device transmits a first healthy signal to the first group at regular intervals. A management system in which the second processing unit of the second server device switches from the backup state to the master state based on the first healthy signal transmitted from the first server device to the first group. [Item 2] (First server device, second server device) The management system according to item 1, wherein the second processing unit of the second server device, when switched to the master state, leaves the first group and generates a second group that receives data transmitted from the second server device. [Item 3] (First server device, second server device) The management system according to item 2, wherein the second processing unit of the second server device transmits a second healthy signal to the second group at regular intervals. [Item 4] (First server device, second server device) The first healthy signal is a signal that counts up or counts down at a predetermined interval. The management system according to any one of items 1 to 3, wherein the second processing unit of the second server device switches from the backup state to the master state when the value of the first healthy signal transmitted from the first server device to the first group does not change over a predetermined period of time. [Item 5] (First server device, second server device) The management system according to any one of items 1 to 4, wherein the second processing unit of the second server device switches from the backup state to the master state when the first healthy signal transmitted from the first server device to the first group is not received. [Item 6] (Client device) The system further comprises one or more client devices including a third processing unit, During normal operation, the client device is a member of the first group. The management system according to item 2, wherein the third processing unit of the client device leaves the first group and joins the second group based on a first healthy signal transmitted from the first server device to the first group. [Item 7] (Client device) The management system according to item 6, wherein the third processing unit of the client device accesses the first database of the first server device when it is a member of the first group, and accesses the second database of the second server device when it is a member of the second group. [Item 8] (Database Equality) The first processing unit of the first server device creates a first update history when the first database is updated, and the second processing unit of the second server device performs equalization from the first database to the second database based on the first update history. A management system according to any one of items 1 to 7, wherein the second processing unit of the second server device creates a second update history when the second database is updated, and the first processing unit of the first server device performs equalization from the second database to the first database based on the second update history. [Explanation of Symbols]

[0059] 1. Control System 10. First Server Device 11. First Processing Unit 12. First Memory Unit 12a First Healthy Counter 13. The first database 20 Second Server Device 21 Second Processing Unit 22 Second Memory Unit 22a Second Healthy Counter 23 Second Database 30 client devices 30a Client device 30b Client device 31 Third Processing Unit 32 Third Memory Unit 33 Display section 34 Input section 40 Industrial Controllers 50 Field Instruments 61 Control Network 61a Control Network 61b Control Network 62 Field Networks 100 Management Systems

Claims

1. A control system for industrial controllers, A first server device including a first processing unit and a first database in which the control program is registered, A second server device including a second processing unit and a second database in which the control program is registered, One or more client devices including a third processing unit, Equipped with, During normal operation, the first processing unit of the first server device is in master mode, the second processing unit of the second server device is in backup mode, and the second server device is a member of a first group that receives data transmitted from the first server device. The first processing unit of the first server device transmits a first healthy signal to the first group at regular intervals. The second processing unit of the second server device switches from the backup state to the master state based on the first healthy signal transmitted from the first server device to the first group. When the second processing unit of the second server device switches to the master state, it separates from the first group and generates a second group that receives data transmitted from the second server device. During normal operation, the client device is a member of the first group. The third processing unit of the client device, based on the first healthy signal transmitted from the first server device to the first group, leaves the first group and joins the second group. Management system.

2. The management system according to claim 1, wherein the second processing unit of the second server device transmits a second healthy signal to the second group at regular intervals.

3. The first healthy signal is a signal that counts up or counts down at a predetermined interval. The management system according to claim 1, wherein the second processing unit of the second server device switches from the backup state to the master state when the value of the first healthy signal transmitted from the first server device to the first group does not change over a predetermined period of time.

4. The management system according to claim 1, wherein the second processing unit of the second server device switches from the backup state to the master state when the first healthy signal transmitted from the first server device to the first group is not received.

5. The management system according to claim 1, wherein the third processing unit of the client device accesses the first database of the first server device when it is a member of the first group, and accesses the second database of the second server device when it is a member of the second group.

6. The first processing unit of the first server device creates a first update history when the first database is updated, and the second processing unit of the second server device performs equalization from the first database to the second database based on the first update history. The management system according to claim 1, wherein the second processing unit of the second server device creates a second update history when the second database is updated, and the first processing unit of the first server device performs equalization from the second database to the first database based on the second update history.

Images