Distributed control system, control device, control method, and computer program product

According to one embodiment, a distributed control system comprises a communication network and a plurality of control devices configured to control devices to be controlled, respectively. The control devices each include a simulator to which a program organization unit is allocated in advance, configured to simulate the allocated program organization unit, and a shared memory that stores a simulation result of the program organization unit simulated by the simulator to be shared with another control device. At least one of the control devices includes a simulation table database that can store therein an execution time of each of the program organization units allocated in advance to the control devices, and a simulation commander that stores, in the simulation table database, the execution time of each of the program organization units corresponding to the simulation result.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is national stage application of International Application No. PCT/JP2015/081381, filed Nov. 6, 2015, which designates the United States, incorporated herein by reference, and which claims the benefit of priority from Japanese Patent Application No. 2014-230081, filed Nov. 12, 2014, the entire contents of which are incorporated herein by reference.

FIELD

An embodiment described herein relates generally to a distributed control system, a control device, a control method, and a computer program product.

BACKGROUND

Control systems for use in plants have been known, in which controllers are connected to respective distributed communication modules to operate the entire control system in coordination with one another via a communication network.

Such a control system is required for exerting real-time performance which enables transmission of communication frames containing a control command and control data via the communication network within a pre-defined period of time.

Meanwhile, so-called cloud computing has been known as one form of the utilization of the computer, in which a server is controlled to carry out actual operations and save data via communication network such as the Internet, providing a user the operations and data for use as a service.

In order to distribute loads to local systems in the control system for a plant, however, introduction of the cloud computing may makes it difficult for the control system to maintain real-time performance.

Meanwhile, conventional local control systems widely adopt sequence control, most of which is implemented as software to operate on a programmable logic controller (PLC).

The PLC as a control device is configured as a compact-size computer and, as with other computers, carries out operations by software on a microprocessor and uses as a behavioral model a state machine which is built upon a relay circuit.

For developing a large-scale control system, control devices (PLCs) need to work in coordination with one another, however, operation allocation to the PLCs is entrusted to designers of the control system. Thus, the operation allocation may not be always optimal.

DETAILED DESCRIPTION

In general, according to one embodiment, a distributed control system comprises a communication network, and a plurality of control devices connected to each other via the communication network, configured to control devices to be controlled, respectively. The control devices each include a simulator to which a program organization unit is allocated in advance, configured to simulate the allocated program organization unit, the program organization unit constituting part of a control program executed in the distributed control system, and a shared memory that stores a simulation result of the program organization unit simulated by the simulator to be shared with another control device. At least one of the control devices includes a simulation table database that can store therein an execution time of each of the program organization units allocated in advance to the control devices, and a simulation commander that stores, in the simulation table database, the execution time of each of the program organization units corresponding to the simulation result, referring to the shared memory.

[1] First Embodiment

FIG. 1is a schematic configuration block diagram of a distributed control system according to an embodiment.

A distributed control system10generally includes a server system11and multiple local control systems13-1to13-n(where n is an integer equal to or larger than two) connected to the server system11via a communication network12.

Configurations of the local control systems13-1to13-nwill be now described.

The local control systems13-1to13-nhave similar configurations. In the following the local control system13-1will be described as an example.

FIG. 2is a schematic configuration block diagram of the local control system.

The local control system13-1includes a communication module21, multiple human machine interfaces (HMIs)23-1to23-x(where x is an integer equal to or larger than two), multiple PLCs24-1to24-y(where y is an integer equal to or larger than two), and multiple remote I/Os25-1to25-z(where z is an integer equal to or larger than two). The communication module21works as an interface to the communication network. The human machine interfaces (HMIs)23-1to23-xare connected to the communication module21via a LAN22for allowing an operator to carry out various types of operation. The PLCs24-1to24-ycontrol respective output devices (controlled devices) connected to the PLCs24-1to24-y. The remote I/Os25-1to25-zwork as interfaces to the respective output devices connected to the remote I/Os25-1to25-z.

Next, a configuration of the PLCs will be described.

The PLCs24-1to24-yhave similar configurations, therefore, the PLC24-1will be described as an example in the following.

FIG. 3is a schematic configuration block diagram of the PLC.

The PLC24-1includes an input terminal unit31, an input interface32, an output terminal unit33, an output interface34, and a control unit35. The input terminal unit31includes input terminals to which various input devices such as a switch, a sensor, and a signal generator are connected. The input interface32is connected to the input terminal unit31to work as an input interface. The output terminal unit33includes multiple output terminals to which various output devices (controlled devices) such as a valve, a lamp, a buzzer, and an actuator are connected. The output interface34is connected to the output terminal unit33to work as an output interface. The control unit35is connected to the input interface32and the output interface34to control the entire PLC24-1.

In the aforementioned configuration, the control unit35is configured as a micro computer and includes an MPU41that controls the entire control unit35, a ROM42that stores various types of data including a control program in a non-volatile manner, a RAM43used as a work area that temporarily stores various types of data, a flash ROM44that stores various types of data such as a control parameter in a non-volatile and updatable manner, a communication interface45for communicating with the other PLCs or a server via the communication network, and a bus46that communicably connects the respective elements.

Next, a functional configuration of the local control system13-1will be described.

FIG. 4is a schematic functional block diagram of the local control system.

The communication module21of the local control system13-1includes a communication unit51that performs communication (packet communication) with the server system11, a network shared memory52that stores therein data to be shared with the PLCs24-1to24-yconnected via the LAN22, and an input unit53that inputs input information placed in the network shared memory52to the communication unit51.

The communication module21also includes an output determiner54that compares a result of calculation by the server system11received via the communication unit51and a result of calculation by the local control system13-1stored in the network shared memory52to select one of the calculation results on the basis of a result of the comparison and then stores the selected calculation result in a certain calculation result storage area.

The communication module21further includes a distribution server55that determines to which one of the PLCs24-1to24-yconnected via the LAN22a program organization unit (POU) is allocated. The POU is created by modularizing each function of a program for executing the entire processing of the local control system13-1.

In the embodiment the program organization unit is not necessarily created for the PLC24-1to the PLC24-yto execute their individual operations. That is, it only assumes part of a function to be implemented in the local control system13-1. For example, the result of the program organization unit POU executed by the PLC24-1may not be used by the PLC24-1but by the PLC24-3. In view of this, the distribution server55allocates program organization units POU to the PLCs so as to enhance execution efficiency of the entire local control system13-1. Details of the allocation will be described later.

In the above configuration, the communication module21communicates with the server system11and acquires a task to be executed by the local control system13-1(a main scan task TM or a high-speed scan task TH described later) every time the task is changed or updated, to distribute the task to the PLCs24-1to24-yconnected via the LAN22.

Meanwhile, each of the PLC24-1to PLC24-yincludes a network shared memory61, a simulator62, and an input/output unit63. The network shared memory61stores data therein to be shared with the other PLCs and the communication module21connected via the LAN22. The simulator62executes, at timing at which a scan period starts, the program organization unit POU corresponding to a main scan task (MS task) TM or a high-speed scan task (HS task) TH which are allocated by the distribution server55, to write (store) a result of the calculation to a certain region of the network shared memory61as a local calculation result as well as to write an execution flag indicating completion of the calculation to a certain region of the network shared memory61. The main scan task TM is to be executed with a lower priority and has a longer maximum allowable execution time and the high-speed scan task TH is to be executed with a higher priority and has a shorter maximum allowable execution time. The input/output unit63outputs, as output information, a calculation result to a corresponding output device at timing at which the scan period ends.

Now, the allocation of the program organization units POU to the PLC24-1to PLC24-ywill be described.

Typically, processors such as an MPU and a DSU have strengths and weaknesses in terms of calculations (e.g., radix calculation, complementary calculation, floating-point calculation, and shift calculation), and differ in usable resources (e.g., a memory and a cache) depending on hardware configuration.

That is, the MPUs41serving as processors of the PLC24-1to PLC24-ysimilarly have strengths and weaknesses in the calculations (e.g., radix calculation, complementary calculation, floating-point calculation, and shift calculation). Even the same processor differs in calculation speed due to the frequency of an interruption (number of controlled devices), for example.

Because of this, the processors and the PLCs execute the same program organization unit POU at individually different calculation speeds.

In view of this, in the first embodiment, one of the PLCs of each of the local control systems13-1to13-nincludes a simulator commander that instructs the PLCs of each local control system to perform an operation simulation, collect information for allocating the program organization units in advance, and create an allocation reference.

Specifically, in the following it is assumed that the PLC24-3includes the simulator commander.

FIG. 5is a block diagram illustrating a functional configuration of the PLC including the simulator commander.

The PLC24-3provided with a simulator commander65communicates with the communication modules21(or the PLCs (nodes) of the other local control systems13-2to13-n) to acquire a task every time the task is changed or updated. The simulator commander65sets, at a certain address of the network shared memory61, a simulation flag indicating that the simulator commander65is performing not actual control but a simulation.

The contents of the network shared memory61are reflected in the network shared memory52of the communication module21in the local control system13-1as well.

As a result, when the simulation flag is set at a certain address of the network shared memory52, the distribution server55of the communication module21in the local control system13-1(refer toFIG. 4) temporarily stops the allocation of the program organization units POU. Following this, the simulator commander65of the PLC24-3transmits allocation information to the distribution server55via, for example, the network shared memory52in response to an instruction from an operator to allocate the program organization unit in question to a certain PLC. Thereby, the distribution server55can allocate an intended program organization unit to the certain PLC in accordance with the operator's simulation instruction.

FIG. 6is an explanatory diagram of a simulation table database.

In the embodiment, the simulator commander65holds the instructions of the operator in advance as a simulation table database (DB)70in reality.

Specifically, the simulator commander65overwrites the allocation information in order to allocate the certain program organization units POU to the respective PLCs24-1to24-yof the local control system13-1on the basis of the simulation table database (simulation list)70designed by a user.

Consequently, the simulator62of each of the PLCs24-1to24-yof the local control system13-1starts, at the scan-period start timing, calculations in the allocated program organization unit on the basis of the allocation information and then records a result of the calculations in the network shared memory61as a local execution result (calculation result).

The input/output unit63of each of the PLCs24-1to24-yof the local control system13-1does not output the calculation result to the output device as the output information at the scan-period end timing when the simulation flag is set at the certain address of the network shared memory61. This is because the calculation result of the allocated program organization unit POU is a simulation. Thus, a simulation result is prevented from being used in the control.

Thereby, the PLC24-3also functioning as the simulator commander65monitors the network shared memory61to which the calculation result is output and stores a length of time taken for executing the calculation in question (calculation time) in the simulation table database70as a simulation result.

As illustrated inFIG. 6, the simulation table database70includes, for each of the PLCs24-1to24-y, simulation-mode data71containing simulation flags, allocation information data72-1to72-yfor designating the allocation of tasks to be simulated depending on priorities of the tasks, and execution-result data73-1to73-ycontaining calculation time (simulation time) for each task.

For example, in the example inFIG. 6, the PLC24-1has a program organization unit POU1and a program organization unit POU2allocated thereto, as indicated in the allocation information data72-1, the program organization units POU1and POU2serving as the main scan tasks TM having lower priorities and longer maximum allowable execution times (e.g., 1000 ms). Their execution-result data73-1indicates 200 ms and 350 ms, respectively.

In addition, the PLC24-1has a program organization unit POU4and a program organization unit POU7allocated thereto as indicated in the allocation information data72-1, the program organization units POU4and POU7serving as the high-speed scan tasks TH having higher priorities and shorter maximum allowable execution times (e.g., 100 ms). Their execution-result data73-1indicates 70 ms and 50 ms, respectively.

Likewise, the PLC24-2has a program organization unit POU3serving as the main scan task TM allocated thereto as indicated in the allocation information data72-2. The execution-result data73-2thereof indicates 100 ms.

The PLC24-2also has a program organization unit POU8serving as the high-speed scan task TH allocated thereto as indicated in the allocation information data72-2. The execution-result thereof is 125 ms as indicated in the execution result data73-2.

The PLC24-yhas a program organization unit POU37serving as the main scan task allocated thereto as indicated in the allocation information data72-y. The execution-result data thereof indicates 1,150 ms.

The PLC24-yalso has a program organization unit POU42serving as the high-speed scan task allocated thereto as indicated in the allocation information data72-y. The execution result thereof is 85 ms as indicated in the execution-result data73-y.

Thus, to allocate the program organization units on the basis of the simulation results in the example above, it is determined for the PLC24-1that the program organization unit POU1and the program organization unit POU2serving as the main scan tasks can be allocated to the PLC24-1because the execution times for the program organization unit POU1and the program organization unit POU2fall within the maximum allowable execution time for the main scan task (e.g., 1000 ms).

Likewise, it is determined that the program organization unit POU4serving as the high-speed scan task can be allocated to the PLC24-1because the execution time for the program organization unit POU4falls within the maximum allowable execution time for the high-speed scan task (e.g., 100 ms).

As for the PLC24-2, it is determined that the program organization unit POU3serving as the main scan task can be allocated to the PLC24-2because the execution time of the program organization unit POU3falls within the maximum allowable execution time of the main scan task (e.g., 1000 ms).

However, it is determined that the program organization unit POU8serving as the high-speed scan task TH cannot be allocated to the PLC24-2because the execution time of the functional unit program POU8is 125 ms over the maximum allowable execution time of the high-speed scan task (e.g., 100 ms).

Likewise, as for the PLC24-y, the execution time of the program organization unit POU37is 1150 over the maximum allowable execution time of the main scan task (e.g., 1000 ms), therefore, it is determined that the program organization unit POU37serving as the main scan task cannot be allocated to the PLC24-y.

In addition, it is determined that the program organization unit POU42serving as the high-speed scan task TH can be allocated to the PLC24ybecause the execution time of the program organization unit POU42falls within the maximum allowable execution time of the high-speed scan task TH (e.g., 100 ms).

As described thus far, it is made possible to properly understand a calculation characteristic of each of the PLC24-1to the PLC24-yof the local control system and to distribute loads thereto. It is also possible to use the simulation result as an indicator for deciding the number of the PLCs (the number of nodes) for a local side. Specifically, when the number of the program organization units to be allocated to the PLCs is determined to be too large, the number of the PLCs can be increased to an optimum number (=y).

Meanwhile, actual system designing needs to assume occurrence of a failure in the PLC.

For example, failures in the PLC24-1to the PLC24-ycan be assumed to arise from failures in the input/output units63and the simulator units62.

In order to detect a failure in the input/output units63and the simulators62, it is necessary to monitor an area (address), of the network shared memory52, from or to which the input/output units63or the simulators62periodically outputs or inputs data.

For example, the distribution server55monitors the area (address) to or from which the input/output unit63or the simulator62inputs or outputs data periodically.

More specifically, in the case of finding no periodic inputs or outputs to the area (address) from the simulator62while monitoring the area, the distribution server55determines the simulator62concerned as having a failure and distributes (allocates) program organization units to the PLCs (nodes) except for that including the simulator62concerned.

Alternatively, an alternative PLC (alternative node) that can substitute for the PLC (node) having a failure may be explicitly set in advance. For example, the simulation table database70may contain alternative PLC specifying data for specifying the alternative PLC (alternative node).

FIG. 7is an explanatory diagram of another simulation table database.

As illustrated inFIG. 7, with alternative PLC specifying data74provided, the PLC24-1can function as an alternative PLC for the one having a failure, for example, the PLC24-2.

Meanwhile, in the case of occurrence of a failure in the input/output unit63, the execution of the program organization unit POU referring to the inputs cannot produce an execution result, which is meaningless. In view of this, the distribution server55can be configured so as to distribute other program organization units than the program organization unit concerned. In a case where the alternative PLC is explicitly specified for the PLC having the input/output unit63with a failure, the distribution server55can operate, ignoring the PLC with a failure.

According to such a configuration, it is made possible to properly recognize a failure in each of the PLCs (nodes) of the local control system when it occurs, and properly distribute loads to the PLCs.

[2] Second Embodiment

The above embodiment has described a configuration in which the program organization units are allocated to the PLCs of the local control system for distributed processing on the basis of a control instruction from the server system11. According to the present embodiment, the server system11also runs the same program organization units POU as those allocated to the PLCs of each of the local control systems13-1to13-n. When resultants thereof match with each other, the PLCs are determined to normally operate. On the other hand, when the resultants do not match with each other (differ from each other), the determination made by the local control systems13-1to13-nis adopted with priority.

FIG. 8is a schematic functional configuration diagram of a communication module according to a second embodiment.

Input information to an input unit53of a communication module21corresponds to output information to an output determiner54from the local control systems13-1to13-none by one with respect to the same program organization unit POU in the same scan period.

In view of this, the second embodiment includes an input/output database56that records and stores information on data input and data output, to compare execution results of the program organization units POU executed by both of the server system11and the local control systems13-1to13-nfor operation control.

FIG. 9is an explanatory diagram of an exemplary input/output database.

The input/output database56includes input/output date and time data81containing dates and time of inputs and outputs, program organization unit specifying data82for specifying the program organization units POU, input data83, server output data84representing execution results by the server system11, local output data85representing execution results by the PLCs, and output determination data86containing results of output determination.

Executions of the same program organization unit POU by the server system11and the PLCs24-1to24-yof the local control systems13-1to13-nare supposed to produce the same result as long as the value of the input data83is unchanged.

This means that as for the same program organization unit POU, a difference in output data relative to the same input data83between the server system11and the corresponding PLC can be determined as occurrence of some kind of anomaly.

For example, in the example inFIG. 9, the input/output date and time data=“2014/06/23 16:14:10:000”, the program organization unit specifying data=“POU1”, the server output data84=“1” (in the scan period of 500 ms), and the local output data85=“0”. Thus, a difference between the server output data84and the local output data85is found by comparison.

As described above, a difference in the output data between the server system11and the local control systems13-1to13-nis suspected to be due to a human induced factor except for a failure in a device.

Hence, the second embodiment stores the results of calculation by the server system11and the local control systems13-1to13-nand utilizes them for troubleshooting in the case of occurrence of a difference therebetween. For example, if a malicious person spoofs a calculation result by the server system on a route, the person's attempt for attacking a system or a plant, what part (where) thereof and when to attack, can be identified.

Furthermore, when a difference is suspected to be due to artificial data manipulation, it is expected that operators are required to act quickly based on code of conduct defined in each factory and each plant. Thus, the difference needs to be promptly sent to the operators.

In such a situation, the input/output database56can be regularly monitored for output determination, and when a difference is found in the output determination, a notification (communication) thereof is sent to a pre-designated device (a PC of HMI or an alarm light) via the communication network (e.g., LAN).

Then, the device receiving the notification may issue a preset alarm (beep sound) or output text information to a display.

In other words, any means can be used for the notification as long as the information can be sent to the operator to be notified in proper expression.

As a result, it is made possible to quickly convey the detection of a difference in the output data due to a human action to the operator, which allows the operator to quickly deal with the situation. This also functions as a business continuity plan (BCP) for ensuring operational continuity of the distributed control system.

As described thus far, according to the respective embodiments, operations can be optimally allocated to the control devices which work in coordination with one another, whereby the reliability of the entire control system can be improved.

In the description thus far, the server system11has been explained as a single device. However, the server system11can be also applied to a cloud server system where multiple server devices are arranged at different locations in the communication network such as the Internet.

The program executed by the control devices according to the embodiments is recorded and provided in an installable or executable file format on a recording medium readable by a computer, such as a CD-ROM, a flexible disk (FD), a CD-R, and a digital versatile disk (DVD).

The program executed by the control devices according to the embodiments may be stored in a computer connected to a network such as the Internet and provided by way of download via the network. Furthermore, the program executed by the control devices according to the embodiments may be provided or distributed via a network such as the Internet.

In addition, the program executed by the control devices according to the embodiments may be incorporated into a ROM or the like in advance and provided.