Plant instrumentation and control system and method for rewriting the program of the plant instrumentation and control system

Abstract

To provide a plant instrumentation control system and a program rewriting method for the plant instrumentation control system with which an unverified update version program is never put into action.SOLUTION: When a program for controlling a controlled device is operating in each of an execution region of a control system controller 10A and an execution region of a standby system controller 10B, a program in a non-execution region of the standby system controller 10B is rewritten with an update version program. In response to an instruction input indicating that there is no problem in the update version program from an operator of an engineering tool 30, the execution region of the standby system controller 10B is switched with a non-execution region, and then control switching is performed such that the control system controller 10A is provided as a standby system controller and the standby system controller 10B is provided as a control system controller.SELECTED DRAWING: Figure 1

Description

Technical Field

[0004] , , , ,

[0005] , , ,

[0001] This application relates to a plant instrumentation control system and a method for rewriting a program of the plant instrumentation control system.

Background Art

[0002] Conventionally, in an instrumentation control system, when updating the program of a dual control device, before operating the updated program, first, the updated program is introduced into the standby control device, and the input data of the control system control device where the pre-update program still operates is used as the input of the standby control device to operate the updated program, and the operation results of both programs before and after the update are compared (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the conventional plant instrumentation control system and the method for rewriting the program of the plant instrumentation control system, when writing the updated program into the standby control device and comparing and verifying the operation results of both programs before and after the update, if it is found that there is an error in the program and it is necessary to return to the state before the update, the operator has to write the pre-update program into the standby control device again from the engineering tool, which is time-consuming.

[0005] Also, when writing the updated program into the standby control device and before the operation verification of the updated program is completed, if an abnormality occurs due to factors such as disturbances and the switching between the control system and the standby system is performed between the control devices, there is a problem that the un-verified updated program may be put into actual operation.

[0006] This application discloses technology to solve the above-mentioned problems, and aims to provide a plant instrumentation control system and a method for rewriting the program of a plant instrumentation control system that can easily restore the program to its pre-update state when an error is found in the program after writing an updated program to a standby control device and comparing and verifying the operation results of both the pre-update and post-update programs, and can also prevent the system from operating with the unverified updated program when an abnormality occurs due to factors such as disturbances and a switchover between the control system and standby system occurs between the control devices after writing an updated program to the standby control device and before the operation verification of the updated program is complete. [Means for solving the problem]

[0007] The plant instrumentation and control system disclosed herein is A redundant control system comprising a control device for a control system that controls a controlled object, and a standby control device that serves as a backup device for the control device of the control system, An input / output device that performs input and output to the aforementioned redundant control device, The redundant control device includes an engineering tool for editing the programs of the two control devices and for engineering the data used by the two control devices, Each of the control devices comprises a first program memory area for storing the program of the control device and a second program memory area for storing the program of the control device, wherein when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area that does not control the controlled device, and the execution area and the non-execution area are interchangeable. A processing unit that reads input data from the input / output device and executes the program on the execution area and the non-execution area. 、 Each of the control devices includes an equivalence processing unit that equivalents the contents of the execution area with the contents of the non-execution area, When the program that controls the controlled object is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, The program in the non-execution area of ​​the standby control device is rewritten with the updated program. After receiving an instruction from the operator of the engineering tool that there are no problems with the updated program, the execution area and non-execution area of ​​the standby control device are swapped. The equivalence processing unit of the standby system control device equivalents the contents of the execution area of ​​the standby system control device with the contents of the non-execution area. A standby / standby switching operation is performed, where the control device of the control system is used as the control device of the standby system, and the control device of the standby system is used as the control device of the control system. stomach, After the aforementioned standby switching has resulted in the writing of the updated program to the non-execution area of ​​the control device that has become the current standby system, the equivalence processing unit of the control device that has become the current standby system equivalents the contents of the execution area of ​​the control device that has become the current standby system with the contents of the non-execution area. It is. Furthermore, the plant instrumentation and control system disclosed herein is A redundant control system comprising a control device for a control system that controls a controlled object, and a standby control device that serves as a backup device for the control device of the control system, An input / output device that performs input and output to the aforementioned redundant control device, The redundant control device includes an engineering tool for editing the programs of the two control devices and for engineering the data used by the control devices, Each of the control devices comprises a first program memory area for storing the program of the control device and a second program memory area for storing the program of the control device, wherein when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area that does not control the controlled device, and the execution area and the non-execution area are interchangeable. An equivalence processing unit that equips the contents of the execution area with the contents of the non-execution area, The system includes an arithmetic processing unit that reads input data from the input / output device and executes the program on the execution area and the non-execution area, A normal range setting file that sets the normal range of the output value of the calculation processing unit by the program in the non-executable area of ​​the control device of the standby system, The control device of the standby system includes a determination processing unit that compares the output value of the program in the non-execution area of ​​the control device with the output value described in the normal range setting file, and determines whether or not to continue the program rewriting operation in the non-execution area of ​​the control device of the standby system, When the program that controls the controlled object is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, If the determination processing unit determines that the rewriting operation should continue, After swapping the execution area and the non-execution area of ​​the standby control device, the equivalence processing unit of the standby control device equips the contents of the execution area of ​​the standby control device with the contents of the non-execution area. A standby / standby switching is performed, where the control device of the control system is used as the control device of the standby system, and the control device of the standby system is used as the control device of the control system. As a result of the aforementioned switching to standby mode, the equivalence processing unit of the control device that has become a standby system equivalents the contents of the execution area of ​​the control device that has become a standby system with the contents of the non-execution area. Furthermore, the method for rewriting the program of a plant instrumentation control system disclosed in this application is: A redundant control system comprising a control device for a control system that controls a controlled object, and a standby control device that serves as a backup device for the control device of the control system, An input / output device that performs input and output to the aforementioned redundant control device, The redundant control device includes an engineering tool for editing the programs of the two control devices and for engineering the data used by the two control devices, Each of the control devices comprises a first program memory area for storing the program of the control device and a second program memory area for storing the program of the control device, wherein when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area that does not control the controlled device, and the execution area and the non-execution area are interchangeable. An equivalence processing unit that equips the contents of the execution area with the contents of the non-execution area, Using an arithmetic processing unit that reads input data from the input / output device and executes the program on the execution area and the non-execution area, When the program that controls the controlled object is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, A first rewriting step of rewriting the program in the non-executable area of ​​the control device of the standby system with an updated program, A first equivalence step of equating the contents of the execution area of ​​the control device of the standby system with the contents of the non-execution area of ​​the control device of the standby system, A standby / standby switching process in which the control device of the control system is used as the control device of the standby system, and the control device of the standby system is used as the control device of the control system, A second rewriting step involves rewriting the program in the non-executable area of ​​the current standby control device with the updated program, The process involves performing a second equivalence step, which involves equating the contents of the execution area of ​​the current standby control device with the contents of the non-execution area of ​​the standby control device. [Effects of the Invention]

[0008] According to the method for rewriting the program of a plant instrumentation and control system disclosed herein, By writing the updated program to the standby control unit and comparing the operational results of both the pre- and post-update programs, it is possible to easily revert to the previous state if an error is found in the program.

[0009] Also, even when an update program is written into the standby control device and an abnormality occurs due to factors such as disturbances at a stage where the operation verification of the update program is incomplete, and the control system and standby system are switched between control devices, the un-verified update program will not be put into actual operation.

Brief Description of Drawings

[0010] [Figure 1] It is a diagram showing the configuration of the plant instrumentation control system according to Embodiment 1. [Figure 2] It is an enlarged view of the main part of FIG. 1. [Figure 3] It is an enlarged view of the main part of FIG. 1. [Figure 4] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 1 in chronological order. [Figure 5] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 1 in chronological order. [Figure 6] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 1 in chronological order. [Figure 7] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 1 in chronological order. [Figure 8] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 2 in chronological order. [Figure 9] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 2 in chronological order. [Figure 10] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 3 in chronological order. [Figure 11] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 3 in chronological order. [Figure 12] It is a diagram for explaining the method of rewriting the program of the dual control device according to Embodiment 3 in chronological order. [Figure 13]This diagram illustrates the method for rewriting the program of the redundant control device according to Embodiment 4, in chronological order. [Figure 14] This is an enlarged view of the main part of Figure 13. [Figure 15] This diagram illustrates the method for rewriting the program of the redundant control device according to Embodiment 4, in chronological order. [Figure 16] This diagram illustrates the method for rewriting the program of the redundant control device according to Embodiment 4, in chronological order. [Figure 17] This diagram illustrates the method for rewriting the program of the redundant control device according to Embodiment 4, in chronological order. [Modes for carrying out the invention]

[0011] Embodiment 1. The plant instrumentation control system according to Embodiment 1 and the method for rewriting the program of the plant instrumentation control system will be described below with reference to the figures. Figure 1 shows the configuration of the plant instrumentation and control system 100. Figures 2 and 3 are enlarged views of the main parts of Figure 1. The plant instrumentation control system 100 comprises a redundant redundant control device 10 that controls controlled devices of a plant (not shown), an input / output device 20 that inputs and outputs data to and from the redundant control device 10, an engineering tool 30 that edits the control programs (hereinafter simply referred to as "programs") of the two control devices 10A and 10B that constitute the redundant control device 10 and engineers various data used by the control devices 10A and 10B, and a maintenance network 50 that connects the redundant control device 10, the input / output device 20, the engineering tool 30, and the controlled devices described above for communication.

[0012] The redundant control device 10 comprises a control device 10A and a control device 10B. Control devices 10A and 10B are so-called redundant control devices, with one of them acting as the control device for the plant control system, and the other acting as the standby control device, a backup device. The standby control device is provided to back up as the control device for the control system when the programs of the respective control devices 10A and 10B of the redundant control device 10 are updated, or when a sudden malfunction occurs in the control system control device.

[0013] Next, the configuration of the control device 10A will be described. The control device 10A comprises an equivalence processing unit 11A, a storage device 12A, and an arithmetic processing unit 13A.

[0014] The storage device 12A includes a redundant memory area consisting of a program memory area 12AP1 (first program memory area) and a program memory area 12AP2 (second program memory area) for storing programs for the control device 10A. The equivalence processing unit 11A performs equivalence on the program memory area 12AP1 and the program memory area 12AP2. The arithmetic processing unit 13A reads the input data from the input / output device 20, executes the programs on the program memory areas 12AP1 and 12AP2, and outputs the output data to the input / output device 20.

[0015] Furthermore, either program memory area 12AP1 or program memory area 12AP2 will be an execution area for performing plant control (control of the controlled device), while the other will be a non-execution area that does not perform plant control. However, the execution area of ​​the standby system's control device is a program memory area that is scheduled to perform plant control when a standby switchover occurs, where the control system and standby system of the redundant control device 10 switch over. The program memory area that becomes a non-execution area is used when updating the program of the control device 10A, which will be described in detail later.

[0016] Next, the configuration of the control device 10B will be described. The control device 10B comprises an equivalence processing unit 11B, a storage device 12B, and an arithmetic processing unit 13B.

[0017] The storage device 12B includes a redundant memory area consisting of a program memory area 12BP1 (first program memory area) and a program memory area 12BP2 (second program memory area) for storing programs for the control device 10B. The equivalence processing unit 11B performs equivalence of program memory area 12BP1 and program memory area 12BP2. The arithmetic processing unit 13B reads input data from input / output device 20, executes the programs on program memory areas 12BP1 and 12BP2, and outputs output data to input / output device 20.

[0018] Furthermore, either program memory area 12BP1 or program memory area 12BP2 will become an execution area for performing plant control, while the other will become a non-execution area that does not perform plant control. The program memory area that becomes a non-execution area is used when updating the program of the control device 10B, which will be described in detail later.

[0019] The engineering tool 30 includes a program editor / monitor unit 31 that provides editor and monitor functions for programs running on the control devices 10A and 10B, and an output list display unit 32 that displays a list of output results calculated by the arithmetic processing units 13A and 13B of the control devices 10A and 10B, and provides a function to check the differences in the output results of both systems.

[0020] Next, the method for online rewriting the program of the redundant control device 10 will be explained using Figures 2 to 4. Figures 4 to 7 illustrate the method for rewriting the program of the redundant control device 10 in chronological order. In Figure 4, the redundant control device 10 is configured such that control device 10A operates as the control system control device, and control device 10B operates as the standby system control device.

[0021] The same program is written to the program memory areas 12AP1 and 12AP2 of the storage device 12A of the control device 10A, and to the program memory areas 12BP1 and 12BP2 of the storage device 12B of the control device 10B. In other words, the same program runs on control devices 10A and 10B, and furthermore, the program memory areas of each control device 10A and 10B are duplicated.

[0022] In reality, each program in the four program memory areas 12AP1, 12AP2, 12BP1, and 12BP2 operates using input information from the input / output device 20. However, only the program in the program memory area 12AP1 of the control device 10A, which operates as a control system, outputs calculation results to the input / output device 20 and controls the plant.

[0023] As described above, Figure 4 shows the state in which the program on the program memory area 12AP1 of the control device 10A is controlling the plant. Furthermore, in case of a malfunction in control device 10A, control device 10B is in standby mode (the program is running, but no output is produced). When control device 10B switches to the control system's control device, the program on the program memory area 12BP1 of storage device 12B operates as the control system.

[0024] To update the program of the redundant control device 10, follow these steps: First, the operator creates an updated program NP for the redundant control device 10 using the program editor / monitor unit 31 of the engineering tool 30. After completing the creation of the updated program NP, the operator first writes it to the program memory area 12BP2 of the non-executable area of ​​the current standby control device, control device 10B (P1 in Figure 4: First rewrite process).

[0025] Subsequently, the program editor / monitor unit 31 of the engineering tool 30 displays the monitoring results (P2 in Figure 4) of the pre-update program in the program memory area 12AP1 of the control device 10A, which is currently operating as a control system control device, and the updated program NP in the program memory area 12BP2 of the control device 10B, which is operating as a standby system control device. The output list display unit also displays a list of the calculation output results of the pre-update program in the program memory area 12AP1 and the updated program NP in the program memory area 12BP2 (P3 in Figure 4). The operator then uses the output result list to confirm the health of the updated program NP (first comparison step).

[0026] If the operator confirms that there are no problems with the updated program NP, the operator continues rewriting the updated program NP from the engineering tool 30, and the engineering tool 30 issues a switching operation command to the standby control device 10B for the program memory areas 12BP1 and 12BP2 (first execution area switching process).

[0027] Upon receiving the command, the standby control unit 10B switches between the execution area and the non-execution area of ​​the program memory, and the execution area switches from the program memory area 12BP1 to the program memory area 12BP2. After the execution area switch is complete, the equivalence processing unit 11B performs equivalence of the program memory area 12BP2 and the program memory area 12BP1, and the updated program NP is reflected in the program memory area 12BP1 as well (P4 in Figure 5: First equivalence process).

[0028] After completing the writing operation of the updated program NP to the standby control device 10B in this manner, the control system and standby system of the redundant control device 10 are switched, so that control device 10A becomes the standby control device and control device 10B becomes the control system control device (P5 in Figure 6: Standby / Standby Switching Process).

[0029] Next, the updated program is written to the non-executable program memory area 12AP2 of the control device 10A, which is the current standby control device. First, the updated program NP is written to the non-execution program memory area 12AP2 of the control device 10A (P6 in Figure 6: Second rewriting process). Then, the program editor / monitor unit 31 of the engineering tool 30 displays the monitoring results of the updated program NP in the program memory area 12BP2 of the control device 10B, which is the execution area of ​​the current control system, and the updated program NP in the non-execution program memory area 12AP2 of the standby system (P7 in Figure 6). Additionally, the output list display unit 32 displays a list of calculation output results for the updated program NP in the program memory area 12BP2 of the control system and the updated program NP in the program memory area 12AP2 of the standby system (P8 in Figure 6), allowing the operator to confirm the integrity of the updated program NP written to the program memory area 12AP2 of the standby system (Second comparison process).

[0030] If the operator confirms that there are no problems with the updated program NP in the program memory area 12AP2, the operator proceeds with the rewriting process using the engineering tool 30, which then issues an execution area switching command to the control device 10A (second execution area switching process).

[0031] The standby control device 10A switches between the execution area and the non-execution area of ​​the program memory, and the execution area switches from the program memory area 12AP1 to the program memory area 12AP2. After the execution area switchover is complete, the equivalence processing unit 11A performs equivalence between the program memory area 12AP2 and the program memory area 12AP1, and the updated program NP is reflected in the program memory area 12AP1 as well (P9 in Figure 7: Second equivalence process).

[0032] According to the plant instrumentation control system and the method for rewriting the program of the plant instrumentation control system according to Embodiment 1, the program memory areas of the control devices 10A and 10B are duplicated, and a means for verification using the engineering tool 30 is provided, allowing the operator to verify the integrity and enabling safe rewriting of the program in the further duplicated program memory area of ​​the operational redundant control device 10.

[0033] Embodiment 2. The following describes the plant instrumentation control system and the method for rewriting the program of the plant instrumentation control system according to Embodiment 2, focusing on the differences from Embodiment 1. In Embodiment 1, we described the case where the updated program NP was found to be sound after verification. However, in Embodiment 2, by providing a write cancellation function to the redundancy control device 10, the system can be automatically restored to its state before writing.

[0034] Figures 8 and 9 illustrate the method for rewriting the program of the redundant control device 10 in chronological order. As shown in Figure 8, if the updated program NP is written (P1 in Figure 8) and its integrity is checked (P2, P3 in Figure 8), and a problem is found with the updated program NP, the operator can cancel the write operation (P24 in Figure 9), which activates a cancellation function (not shown) of the redundancy control device 10.

[0035] The control unit's cancellation function sets the data in program memory area 12BP1, which holds the pre-update program of the standby control unit 10B, as positive. This equalizes the values ​​of program memory areas BP1 and BP2, and the pre-update program of program memory area BP1 is reflected in program memory area BP2 (P25 in Figure 9). This allows the control unit 10B to be returned to the state before the updated program was written.

[0036] Traditionally, to revert to the state before the program was written, the operator had to prepare the pre-update program and write the pre-update program. However, in this embodiment 2, the restoration itself is performed automatically.

[0037] According to the plant instrumentation control system and the method for rewriting the program of the plant instrumentation control system according to Embodiment 2, even if the updated program NP does not operate properly, the redundant control device 10 can be easily restored to its original state.

[0038] Embodiment 3. The following describes the plant instrumentation control system and the method for rewriting the program of the plant instrumentation control system according to Embodiment 3, focusing on the differences from Embodiments 1 and 2. Embodiment 2 describes a case where the integrity of the updated program NP is checked, and if it is not integrity, the operator cancels the write operation. This embodiment describes a situation where the rewriting of the updated program NP may be aborted due to an event other than a problem with the updated program NP, such as a disturbance.

[0039] Figures 10 to 12 illustrate the method for rewriting the program of the redundant control device 10 in chronological order. As shown in Figure 10, after the updated program NP has been written to the program memory area 12BP2 of the standby control device 10B (P1 in Figure 10), if an abnormality occurs in the control device 10A of the control system due to a disturbance or other factor before the operator has verified the operation of the updated program NP, and the standby / remote switching of the redundant control device 10 is performed (P2 in Figure 11), then control device 10A becomes the control device of the standby system, and control device 10B becomes the control device of the control system. However, the control device 10B of the control system will perform calculations using the program in the program memory area 12BP1 before the update (P3 in Figure 12).

[0040] Conventionally, if the dual control system switched between standby and standby modes after the updated program NP had been written to the standby control unit, the newly designated control unit would perform calculations using the updated program NP. Therefore, if there was a problem with the updated program NP, the dual control system could malfunction. However, according to the instrumentation control system of Embodiment 3, by duplicating the program memory area for both the control unit and the standby control unit, malfunction of the dual control system 10 can be prevented.

[0041] Embodiment 4. The following describes the plant instrumentation control system and the method for rewriting the program of the plant instrumentation control system according to Embodiment 4, focusing on the differences from Embodiments 1 to 3. Embodiments 1 to 3 describe the case in which, after writing the updated program NP to the program memory area 12BP2 of the standby control device 10B, the operator visually checks the output of the calculation results, etc., and operates the engineering tool 30 each time to perform the rewriting of the updated program NP.

[0042] In this embodiment 4, the operator does not need to operate the engineering tool 30 each time, and the rewriting of the updated program NP can be performed automatically.

[0043] Figures 13, 15-17 illustrate the method for rewriting the program of the redundant control device 10 in chronological order. Figure 14 is an enlarged view of the main part of Figure 13. The engineering tool 30 includes an automatic judgment processing unit 33 and a normal range setting file 34.

[0044] The normal range setting file 34 is a file in which the normal ranges (lower limit and upper limit) of various output values ​​of the updated program NP are set in advance. The automatic determination processing unit 33 has already read the normal range setting file 34 (P40 in Figure 13), and after the updated program NP is written to the program memory area 12BP2 (P1 in Figure 13), the automatic determination processing unit 33 determines whether the output result of the calculation by the calculation processing unit 13B falls within the normal range of the normal range setting file 34, and automatically determines whether to continue the rewriting of the updated program NP (P43 in Figure 13). If the rewriting is to be continued, the execution area and non-execution area of ​​the standby control device 10B are swapped, and the program memory area 12BP1 is made equivalent to the program memory area 12BP2 (P45 in Figure 15).

[0045] Next, the redundant control device 10 automatically switches between control device 10A and control device 10B (Figure 16, p. 46). Then, after the updated program is automatically written to the program memory area 12AP2 of control device 10A (Figure 16, p. 47), the automatic determination processing unit 33 determines whether the output result of the calculation by the calculation processing unit 13A falls within the normal range of the normal range setting file 34, and automatically determines whether to continue the rewriting of the updated program NP (Figure 16, p. 48). If the rewriting is to be continued, the execution area and non-execution area of ​​the standby control device 10A are swapped, and the program memory area 12AP1 is made equivalent to the program memory area 12AP2 (Figure 17, p. 50).

[0046] This prevents the redundant control device 10 from malfunctioning due to errors in operator visual inspection, etc., even if there are a large number of changes in the updated program NP. In addition, since the operator does not need to perform operations each time, the rewriting process of the updated program NP can be made more efficient.

[0047] Although this application describes various exemplary embodiments and examples, the various features, aspects, and functions described in one or more embodiments are not limited to the application of a particular embodiment, but can be applied individually or in various combinations to the embodiments. Accordingly, countless variations not illustrated are conceivable within the scope of the art disclosed herein. These include, for example, modifying, adding or omitting at least one component, or even extracting at least one component and combining it with components of other embodiments. [Explanation of Symbols]

[0048] 100 plant instrumentation and control systems, 10 redundant control devices, 10A, 10B Control device, 11A, 11B Equivalence processing unit, 12A,12B storage device, 12AP1, 12AP2, 12BP1, 12BP2 program memory area, 13A, 13B Arithmetic processing unit, 20 Input / Output devices, 30 Engineering tools, 31 Program editor / monitor unit, 32 Output list display unit, 33 Automatic judgment processing unit, 34 Normal range setting file, 50 Maintenance network.

Claims

1. A redundant control system comprising a control device of a control system that controls a controlled object, and a standby control device that serves as a backup device for the control device of the control system, An input / output device that performs input and output to the aforementioned redundant control device, The redundant control device includes an engineering tool for editing the programs of the two control devices and for engineering the data used by the two control devices, Each of the control devices comprises a first program memory area for storing the program of the control device and a second program memory area for storing the program of the control device, wherein when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area that does not control the controlled device, and the execution area and the non-execution area are interchangeable. A processing unit that reads input data from the input / output device and executes the program on the execution area and the non-execution area, Each of the control devices includes an equivalence processing unit that equivalents the contents of the execution area with the contents of the non-execution area, When the program that controls the controlled object is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, The program in the non-execution area of ​​the standby control device is rewritten with the updated program. After receiving an instruction from the operator of the engineering tool that there are no problems with the updated program, the execution area and non-execution area of ​​the standby control device are swapped. The equivalence processing unit of the standby system control device equivalents the contents of the execution area of ​​the standby system control device with the contents of the non-execution area. A standby / standby switching is performed, where the control device of the control system is used as the control device of the standby system, and the control device of the standby system is used as the control device of the control system. A plant instrumentation control system in which, after writing the updated program to the non-execution area of ​​the control device that has become the current standby system due to the aforementioned switching, the equivalence processing unit of the control device that has become the current standby system equivalents the contents of the execution area of ​​the control device that has become the current standby system with the contents of the non-execution area.

2. A redundant control system comprising a control device of a control system that controls a controlled object, and a standby control device that serves as a backup device for the control device of the control system, An input / output device that performs input and output to the aforementioned redundant control device, The redundant control device includes an engineering tool for editing the programs of the two control devices and for engineering the data used by the control devices, Each of the control devices comprises a first program memory area for storing the program of the control device and a second program memory area for storing the program of the control device, wherein when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area that does not control the controlled device, and the execution area and the non-execution area are interchangeable. An equivalence processing unit that equips the contents of the execution area with the contents of the non-execution area, The system includes an arithmetic processing unit that reads input data from the input / output device and executes the program on the execution area and the non-execution area, A normal range setting file that sets the normal range of the output value of the calculation processing unit by the program in the non-executable area of ​​the control device of the standby system, The control device of the standby system includes a determination processing unit that compares the output value of the arithmetic processing unit by the program in the non-execution area of ​​the standby system control device with the output value described in the normal range setting file, and determines whether or not to continue the rewriting operation of the program in the non-execution area of ​​the standby system control device, When the program that controls the controlled object is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, If the determination processing unit determines that the rewriting operation should continue, After swapping the execution area and the non-execution area of ​​the standby control device, the equivalence processing unit of the standby control device equips the contents of the execution area of ​​the standby control device with the contents of the non-execution area. A standby / standby switching is performed, where the control device of the control system is used as the control device of the standby system, and the control device of the standby system is used as the control device of the control system. A plant instrumentation control system in which, due to the aforementioned switching to standby mode, the equivalence processing unit of the control device that has become a standby system equivalents the contents of the execution area of ​​the control device that has become a standby system with the contents of the non-execution area.

3. A redundant control system comprising a control device of a control system that controls a controlled object, and a standby control device that serves as a backup device for the control device of the control system, An input / output device that performs input and output to the aforementioned redundant control device, The redundant control device includes an engineering tool for editing the programs of the two control devices and for engineering the data used by the two control devices, Each of the control devices comprises a first program memory area for storing the program of the control device and a second program memory area for storing the program of the control device, wherein when one of the first program memory area and the second program memory area is an execution area for controlling the controlled device, the other is a non-execution area that does not control the controlled device, and the execution area and the non-execution area are interchangeable. An equivalence processing unit that equips the contents of the execution area with the contents of the non-execution area, Using an arithmetic processing unit that reads input data from the input / output device and executes the program on the execution area and the non-execution area, When the program that controls the controlled object is running in the execution area of ​​the control device of the control system and the execution area of ​​the control device of the standby system, A first rewriting step of rewriting the program in the non-executable area of ​​the control device of the standby system with an updated program, A first equivalence step of equating the contents of the execution area of ​​the control device of the standby system with the contents of the non-execution area of ​​the control device of the standby system, A standby / standby switching process in which the control device of the control system is used as the control device of the standby system, and the control device of the standby system is used as the control device of the control system, A second rewriting step involves rewriting the program in the non-executable area of ​​the current standby control device with the updated program, A method for rewriting the program of a plant instrumentation control system, comprising: a second equivalence step of equating the contents of the execution area of ​​the current standby control system with the contents of the non-execution area of ​​the standby control system.

4. Following the first rewriting step, a first comparison step is performed to compare the output result of the program in the execution area of ​​the control device of the current control system with the output result of the updated program in the non-execution area of ​​the control device of the current standby system. A method for rewriting a program for a plant instrumentation control system according to claim 3, which involves performing a second comparison step after the second rewriting step, in which the output result of the program in the execution area of ​​the control device of the current control system is compared with the output result of the updated program in the non-execution area of ​​the control device of the current standby system.

5. A method for rewriting the program of a plant instrumentation control system according to claim 4, wherein an execution area swapping step is performed after the first rewriting step and the second rewriting step, respectively, to swap the execution area and the non-execution area of ​​the control device of the current standby system.

Images