1. A controller for controlling plant apparatuses, comrising: a CPU module that has an error-state detecting unit for detecting a malfunction of a module, and program-controls a plurality of plant apparatuses in the plant; a5 nd a plurality of remote IO modules that are connected in a daisy-chain to the CPU module by a serial transmission line, and convert digital data transmitted from the CPU module to output the results to the plurality of plant apparatuses, 10 wherein the CPU module, when the error-state detecting unit detects a malfunction, notifies the plurality of remote IO modules of a CPU error, and the plurality of remote IO modules, when notified of the CPU error, make all the plurality of plant apparatuses in inactive states, separately from the control using the digital data. 15 2. The controller according to claim 1, wherein the CPU error is notified from the CPU module to the plurality of remote IO modules via a signal cable that connects in a daisy-chain the CPU module and the plurality of remote IO modules, separately from the serial transmission line.

3. The controller according to claim 1, wherein 20 the plurality of remote IO modules obtain logical products of the CPU error and the digital data to output operation results to the plurality of plant apparatuses.

4. The controller according to claim 1, wherein each of the plurality of remote IO modules includes a transmission-error 25 controlling unit that detects a transmission error and modifies digital data, wherein the transmission-error controlling unit, upon detecting a transmission error, modifies digital data based on predetermined modification rules for every plant apparatus connected.

5. The controller according to claim 4, wherein 30 the modification rule is either to rewrite the digital data to “0” (zero-clear) or to keep the digital data as it has been before detecting the error (hold).

6. A controller comrising: 28 a CPU module; and a plurality of remote IO modules that control a plurality of plant apparatuses in a plant, wherein the CPU module and the plurality of remote IO modules are connected via5 : a serial transmission line that connects in a daisy chain the CPU module and the plurality of remote IO modules, and is used for transmitting control information; and a CPU state signal line that connects in a daisy-chain the CPU module and the 10 plurality of remote IO modules, and is used for transmitting a CPU error from the CPU module to the plurality of remote IO modules.

7. The controller according to claim 6, wherein control information is cyclically transmitted on the serial transmission line, and 15 CPU-state information is transmitted on the CPU-state signal line, asynchronously with the serial transmission line.

8. The controller according to claim 6, wherein the CPU-state information has less data amount than the control information which is transmitted on the serial transmission line. 20 9. A control method for a controller that includes a CPU module and a plurality of remote IO modules, each controlling at least one plant apparatus in a plant, and controls a plurality of plant apparatuses in the plant, the control method comprising: a step of detecting a malfunction of the CPU module that program25 controls the plurality of plant apparatuses in the plant for outputting on the CPU-state signal line a signal indicating an error state; and a step of setting all the operation terminals, by the plurality of remote IO modules that set respective operation terminals of the plurality of plant apparatuses in response to digital data DO which has been 30 notified from the CPU module, in a predetermined state according to a signal indicating an error state via the CPU-state signal line.

10. The control method according to claim 9, further comprising: 29 a step of monitoring, by the plurality of remote IO modules, a serial transmission line that connects the CPU module and the plurality of remote IO modules at a predetermined control cycle, and when a transmission error is detected, modifying the digital data DO notified from the CPU module according to a predetermined modification rul5 e for setting the operation terminal.

11. The control method according to claim 10, wherein a timing when the plurality of remote IO modules set the operation terminals in response to the digital data DO from the CPU module is different from a 10 timing when the plurality of remote IO modules set the operation terminals in response to a signal on the CPU-state signal line indicating an error state.

12. The control method according to claim 10, wherein the plurality of remote IO modules process the step of setting the operation terminals according to a signal on the CPU-state signal line indicaing an error 15 with a higher priority than a step of modifying the digital data DO notified from the CPU module according to the predetermined rule for setting the operation terminals.

CONTROLLER AND CONTROL METHOD OF THE SAME
TECHNICAL FIELD
[0001] The present invention relates to a controller that automatically controls
plant facilities or the like.
BACKGROUND 5 ART
[0002] As a controller for automatic control, there is a system in which a CPU
(Central Processing Unit) module and a plurality of remote Input/Output (IO)
modules are connected by transmission cables. The system is configured such
that the CPU module executes a control program for automatic control to output
10 digital data DO (digital output data), and the remote IO modules convert the
digital data DO received from the CPU module to plant output signals to output
them to operation terminals of the plant facilities.
The controller having the remote IO modules has the advantage that
controlling multiple distributed plant facilities can be achieved with a small
15 footprint at a low cost.
[0003] For example, such a controller is applied to water and sewage plant
inclusive of a plurality of facilities for controlling the plant. Each facility of the
water and sewage plant is composed of a plurality of plant apparatuses, and each
plant apparatus includes an operation terminal. A plant output signal can be
20 outputted from outside to the operation terminal to start and stop operation of
the plant apparatus. The plant output signal is suitably outputted from the
controller or a manual operation device to the operation terminal to achieve the
operation of a single plant apparatus as well as the entire plant.
A malfunction or a shutdown of the controller of water and sewage plant may
25 cause, for example, tap water outage and/or urban flooding to threaten human
life and/or property. Therefore, the controller is required to continue stable
operation for 24 hours a day.
[0004] As described above, a controller for water and sewage plant is required
to have high reliability.
30 If a malfunction is detected in the controller, the plant needs to be either
urgently stopped in order to prevent a malfunction of the plant, or operated, such
as by keeping the plant function in a state prior to detecting the malfunction, by
3
stopping some plant apparatuses to degrade the plant function, or by switching to
manual operation.
[0005] In particular, if the malfunction in the controller is detected to be a
malfunction in a CPU module which is most critical, the plant needs to be
urgently stopped to avoid a risk of erroneously outputting digital data DO due 5 ue to
the CPU malfunction.
In addition, apparatuses that can be noise sources, such as high-voltage
electric facilities, induction motors, and inverters, are installed in water and
sewage plant, and then, when a remote IO module is applied, a noise may be
10 superimposed on a transmission cable that connects the CPU module and the
remote IO module to cause a transient transmission error.
[0006] Conventionally, in view of the above circumstances, a technique has
been proposed for controlling power supply to an external load if an error is
detected in the controller (e.g., see Patent Document 1).
15 According to the technique disclosed in Patent Document 1, an error can be
detected with a pulse output outputted by a main program and an external
electric circuit timer composed of a relay and a timer, and, when an error is
detected, the power supply to the external load is blocked or unblocked to achieve
a fail-safe function.
20 [0007] Further, Patent Document 2 discloses an IO unit that is provided with
an output terminal for checking an error of an MPU 11, and, while checking an
error, sets an outputting state of the output terminal of the IO unit in a state
indicating that a connected IO device is inactive, allowing for detecting in
advance whether there is any failure or error.
25 PRIOR ART DOCUMENTS
Patent Documents
[0008] Patent Document 1: Japanese Patent Application Publication No. H09-
185403
Patent Document 2: Japanese Patent Application Publication No. 2008-310389
30 SUMMARY OF THE INVENTION
Problems to be solved
4
[0009] According to the technique disclosed in Patent Document 1, a pulse
output is monitored by a combination of an on-delay timer and an off-delay timer,
and this requires an error-detection wait time at least two program cycles or
more from the time an error occurs to the time the error is detected. This causes
a problem that an erroneous output to the plant due to a CPU malfuncti5 on
cannot be prevented within the error-detection wait time.
In addition, according to Patent Document 1, an error in any part of the CPU
module, the remote IO module, the main program, transmission, and the external
electric circuit are detected as the same error, and this causes a problem of being
10 incapable of detecting a CPU error, an especially critical error, and immediately
evaluating digital data DO for sure at the time of detecting the error.
Further, there are other problems such that an error cannot be detected for a
transmission which is required for the controller composed of the CPU module
and the remote IO module, and a setting cannot be allowed for selecting an error
15 control operation at the time of detecting an transmission error.
[0010] The technique disclosed in Patent Document 2 allows for detecting in
advance whether there is any failure or error in the IO unit, but there are
problems that no consideration is given to a failure during a production process,
or no consideration is given to a failure of a CPU unit in a Programmable Logic
20 Controller (PLC) or a master unit.
Thus, the techniques disclosed in Patent Documents 1 and 2 cannot achieve
the reliability level required for a controller for water and sewerage.
[0011] The present invention has been made in view of such circumstances to
provide a controller that includes a CPU module and a remote IO module, and is
25 capable of performing control surely as well as selectively at a time of an error
depending on the cause of the error such as a CPU error or a transmission error
to achieve high reliability.
Solution to Problems
[0012] To solve the above problems, a controller for controlling plant
30 apparatuses according to the present invention includes: a CPU module that has
an error-state detecting unit for detecting a malfunction of a module, and
program-controls a plurality of plant apparatuses in a plant; and a plurality of
5
remote IO modules that are connected in a daisy-chain to the CPU module by a
serial transmission line, and convert and output digital data transmitted from
the CPU module to the plant apparatuses, wherein the CPU module, when the
error-state detecting unit detects a malfunction, notifies the plurality of remote
IO modules of a CPU error, and the plurality of remote IO modules, 5 , when
notified of the CPU error, make all the plant apparatuses in an inactive state,
separately from the control using the digital data.
[0013] In addition, in the controller of the present invention, inclusive of the
CPU module and the remote IO modules for controlling a plurality of plant
10 apparatuses in a plant, the CPU module and the remote IO modules are
connected via: a serial transmission line that connects in a daisy chain the CPU
module and the remote IO modules, and is used for transmitting control
information; and a CPU-state signal line that connects in a daisy-chain the CPU
module and the remote IO modules, and is used for transmitting a CPU error
15 from the CPU module to the remote IO modules.
[0014] Further, a control method of the present invention, for a controller that
includes a CPU module and a plurality of remote IO modules, each controlling at
least one plant apparatus in a plant, and controls a plurality of plant
apparatuses in the plant, includes: a step of detecting a malfunction of the CPU
20 module that program-controls the plurality of plant apparatuses in the plant and
outputting on the CPU-state signal line a signal indicating an error state; and a
step of setting all the operation terminals, by the plurality of remote IO modules
that set respective operation terminals of the plurality of plant apparatuses in
response to digital data DO which has been notified from the CPU module, in a
25 predetermined state according to a signal indicating an error state on the CPUstate
signal line.
Advantageous Effects of the Invention
[0015] The present invention allows for improving the reliability level of the
controller.
30 BRIEF DESCRIPTION OF DRAWINGS
[0016] FIG. 1 is a block diagram of a controller of water and sewage plant;
FIG. 2 is a diagram showing an exemplary configuration of a CPU module;
6
FIG. 3 is a time chart for describing an error detection process of a control
program;
FIG. 4 is a diagram showing an exemplary configuration of a remote IO module
and a plant apparatus;
FIG. 5 is a diagram showing a configuration of a CPU-error controlling unit5 ;
FIG. 6 is a diagram showing a configuration of an IO output unit of the remote
IO module;
FIG. 7 is an exemplary time chart of the CPU-error controlling unit;
FIG. 8 is a diagram showing another configuration of the remote IO module;
10 FIG. 9 is an exemplary time chart of digital data DO outputted from a remote IO
transmitting unit;
FIG. 10 is a flowchart of processing operation of the remote IO module;
FIG. 11 is a flowchart of processing a CPU error to be executed asynchronously;
and
15 FIG. 12 is a diagram showing an exemplary water transport plant.
DETAILED DESCRIPTION
First Embodiment
[0017] Hereinafter, embodiments of the present invention will be described in
detail with reference to the drawings.
20 The present embodiment will be described by way of an example of water and
sewage plant, such as water purification plant that takes in raw water from
dams and/or rivers, and processes chemical sedimentation, sand filtration, and
chlorine injection to produce tap water.
[0018] The water and sewage plant such as water purification plant is
25 configured with facilities such as a raw water pump facility, a high-voltage power
receiving facility, a power generator facility for emergency, a chemical injection
facility, a sedimentation pond facility, a filtration pond facility, a chlorine
injection facility, a water pump facility, and a drainage facility. Each of these
facilities includes: controlling devices such as a pump, a motor, a valve, a
30 blocking device, and an engine; and detecting devices such as a water level gauge,
a flow meter, and a water quality sensor.
7
[0019] Some of the controlling devices described above includes a state contact
for outputting an operating state of the device to the outside. Here, the operating
state of the device includes a state of the pump being in operation or inactive, an
open or closed state of the valve such as fully-open, fully-closed, or half-open, an
on or off status of the blocking device, and a failure state of a device5 .
An electrical specification for this state contact is, for example, a binary output
to indicate an electrically conductive state when the pump is in operation, and an
insulated state when the motor is inactive.
In addition, the detecting device includes an analog output terminal for
10 outputting numerical information of the sensor output, such as a current, voltage,
a flow rate, a water level, a water pressure, or a degree of opening, by converting
it to an analog signal such as a voltage or a current.
[0020] Further, some of the controlling devices described above includes an
operation terminal for controlling the operation of the device from the outside.
15 The operation terminal can be made in an electrically conducting state or an
electrically insulated state, to control operation such as starting or stopping the
pump or the motor, opening or closing the valve or a gate, and turning on or off
the blocking device or a capacitor. For example, the operation terminal of the
pump may externally be made in an electrically conducting state to start the
20 pump, or in an electrically insulated state to stop the pump. In this case, as the
operation terminal described above is an analog input terminal for inputting an
analog signal from the outside, the degree of opening, a rotation speed, or the like
of the controlling device is operated in accordance with the signal at the analog
input terminal.
25 The detecting device may sometimes include an analog input terminal.
[0021] FIG. 1 is a block diagram of a controller of water and sewage plant, such
as water purification plant, inclusive of the controlling device as described above.
A controller 1 is configured with a CPU (Central Processing Unit) module 2
and a plurality of remote IO (Remote Input/Output) module 3a, 3b, 3c
30 (hereinafter, collectively referred to as a remote IO module 3).
[0022] The CPU module 2 and the plurality of remote IO modules 3 are
connected in a daisy chaine by a serial transmission line 5 in a multidrop system
8
such as RS-485. A sequence program running in the CPU module 2 accesses the
remote IO modules 3 through the serial transmission line 5 to control a plurality
of plant apparatuses 4a, 4b, 4c, ---, 4i (hereinafter, collectively referred to as a
plant apparatus 4) inclusive of the controlling devices.
In the block diagram in FIG. 1, the system is configured to include a pluralit5 y
of remote IO modules 3, but the system may be configured to include one CPU
module 2 and one remote IO module 3.
[0023] In the following description, digital data to be transmitted between the
CPU module 2 and the remote IO modules 3 via the serial transmission line 5
10 will be referred to such as input digital data DI (Digital Input data) and output
digital data DO (Digital Output data), each in a one-bit pattern, and analog data
will be referred to such as analog input data AI (Analog Input data), analog
output data AO (Analog Output data), and pulse input data PI (Pulse Input data),
each in a word or long-word pattern.
15 [0024] The state contact, the operation terminal, the analog input terminal, and
the analog output terminal of the plurality of plant apparatuses 4 are connected
to the remote IO modules 3 via apparatus connection cables 7a, 7b, 7c, ---, 7i
(hereinafter, collectively referred to as an apparatus connection cable 7 ),
respectively. An electrical specification of the apparatus connection cable 7 has a
20 voltage output such as AC 100 V, AC 200 V, DC 24 V, and DC 48 V, and either a
conducting or insulated state. Alternatively, an analog signal of 4 to 20 mA, 1 to 5
V or the like may pass through the cable.
The remote IO modules 3 can access the state contact, the operation terminal,
the analog input terminal, and the analog output terminal of the plant apparatus
25 4 via the apparatus connection cables 7, and then the CPU module 2 uses the
remote IO modules 3 to control the plant apparatuses 4.
[0025] More specifically, the remote IO module 3 inputs the state of the state
contact of the plant apparatus 4 via the apparatus connection cable 7 as a signal
from the plant apparatus. The inputted state of the state contact of the plant
30 apparatus 4 is converted into digital data DI to be transmitted from the remote
IO module 3 to the CPU module 2. In particular, the state of the state contact of
the plant apparatus 4 is converted to DI of “1” if the state is a conducting state,
9
and DI of “0” if the state is an insulated state. The converted digital data DI of
the state of the state contact of the plant apparatus 4 is transmitted from the
remote IO module 3 to the CPU module 2. In addition, if the plant apparatus 4
outputs the level of a voltage or a current, the state of the analog output terminal
of the plant apparatus 4 is converted to analog input data AI by 5 the AD
conversion, and then is transmitted from the remote IO module 3 to the CPU
module 2.
[0026] When the digital data DO is transmitted from the CPU module 2, the
remote IO module 3 drives the apparatus connection cable 7 to a conducting state
10 or an insulated state to control the operation terminal of the plant apparatus 4.
In particular, the apparatus connection cable 7 is driven to a conducting state if
the DO is “1” and driven to an insulated state if the DO is “0.”
In addition, the remote IO module 3 converts an analog output data AO to an
analog signal by the DA conversion to output the signal to the analog input
15 terminal of the plant apparatus 4.
[0027] Three plant apparatuses 4 are connected to each remote IO module 3 in
FIG. 1, but eight to sixty-four plant apparatuses 4 can be connected to one remote
IO module 3. A plurality of I/O modules 3 are connected to the CPU module 2. In
general, the sum of the number of the state contacts, the operation terminals, the
20 analog input terminals, and the analog output terminals that input to or are
outputted from one controller is in a range of several tens to several thousands.
The apparatus connection cables 7 are laid for each of the state contacts, the
operation terminals, the analog input terminals, and the analog output terminals,
amounting to several tens to several thousands. In a particularly large system,
25 laying the apparatus connection cables 7 is difficult. For this reason, the remote
IO module 3 is applid to facilitate laying the apparatus connection cables 7 by
installing the remote IO module 3 near the plant apparatus 4, however this
requires handling erroneous transmission through the serial transmission line 5.
In addition, the remote IO module 3 is required to handle a mulfunction of the
30 CPU module 2.
The controller 1 of the present embodiment handles a transmission error and a
CPU malfunction as follows.
10
[0028] The CPU module 2 executes a control program based on the digital data
DI or the analog input data AI to output, as an execution result, the digital data
DO or the analog output data AO. In this case, the CPU module 2 of the present
embodiment monitors the status of hardware or programs to detect a malfunction,
so as to output on the CPU-state signal line 6 whether there is any error5 .
[0029] Further, the remote IO module 3 has an error detecting arrangement for
an error in the serial transmission line 5 such as a parity error, and, when it
detects a transmission error, makes the DO for the respective plant apparatuses
4 to “0” (an insulated state) or holds a preceding state before detecting the error.
10 Furthermore, when the CPU-state signal line 6 indicates a CPU error, the
remote IO module 3 drives the operation terminals of all the plant apparatuses 4
in an insulated state, regardless of the state of the digital data DO.
[0030] A description will be given below in detail of a configuration to handle a
transmission error and a CPU malfunction.
15 FIG. 2 is a diagram showing an exemplary configuration of the CPU module 2.
The CPU module 2 includes a CPU 21, a memory 22, a CPU transmitting unit 23,
an error-state detecting unit 25, and an error-state outputting unit 26, which are
mutually connected via a CPU system bus 24. The memory 22 is a RAM (Random
Access Memory) or the like, where a control program 221 and a register 222 are
20 arranged.
[0031] The CPU transmitting unit 23 executes serial communication with the
remote IO module 3 via the transmission cable 5 at a predetermined cycle in pace
with processing of the control program 221, to receive or send, for example,
digital data DI or digital data DO. In addition, the CPU transmitting unit 23
25 receives or sends digital data DI or digital data DO from or to the register 222 via
the system bus 24, to match digital data in the remote IO module 3 and that in
the register 222 (referred to as a refresh process).
[0032] The control program 221 is a program for sequence control and loop
control of the plant apparatus 4, and the register 222 is stored with, for example,
30 digital data DI, digital data DO, analog input data AI, analog output data AO,
and initial and calculated data of the control program.
11
In addition, the control program 221 is periodically executed by the CPU 21.
The content of the state contact of the plant apparatus 4 is converted by the
remote IO module 3 into digital data DI, and then is stored in the register 222 via
the CPU transmitting unit 23 as an input to the control program 221.
The control program 221 inputs the digital data DI from the register 222 5 to
execute program operations such as a logical operation and a numerical operation,
and outputs the digital data DO as a result of the execution. Then, the digital
data DO outputted to the register 222 by the control program 221 is sent to the
remote IO module 3 via the CPU transmitting unit 23 for setting the operation
10 terminal of the plant apparatus 4 at a predetermined cycle.
[0033] FIG. 3 is a time chart for describing an error detection processing of the
control program 221.
The control program 221 repeatedly executes the processing, for example, in a
control cycle of 50 ms, 100 ms, or 200 ms.
15 The processing includes the refresh process for an IO module to make the
digital data in the remote IO module 3 and that in the register 222 equal to each
other, and a program calculation. A result of the program calculation stored in
the register 222 is transmitted to the remote IO module 3 in the refresh process
for the IO module at the next cycle.
20 [0034] If a malfunction of the CPU 21 or the memory 22, or a program error in
the control program 221 occurs, the program calculation may not complete in a
predetermined time.
The error-state detecting unit 25 monitors a processing cycle of the control
program 221 to determine that a CPU error has occurred if the processing cycle
25 of the control program 221 exceeds a predetermined monitoring time.
[0035] More specifically, the error-state detecting unit 25 is arranged with a
monitoring timer that overflows at a predetermined monitoring time, and the
control program 221 initializes and activates the timer at the beginning. If the
control program 221 is operating normally, the monitoring timer does not
30 overflow. However, if the processing of the control program 221 is delayed to
cause the monitoring timer to overflow, it is determined that a CPU malfunction
has occurred.
12
[0036] Alternatively, the refresh process for the IO module and the control
program may be configured so as to be executed independently, and the
processing cycle of the refresh process for the IO module and the control program
may be monitored so as to be determined that a CPU malfunction has occurred if
the processing cycle of either one exceeds a predetermined monitoring time. 5 In
addition, multiple control programs may exist.
[0037] Further, the error-state detecting unit 25 in FIG. 2 may detect a
hardware error such as a checksum error in the ROM and a bit error in the
memory, or a software error such as an OS error and a control program error by
10 way of exception handling caused by illegal instruction execution.
[0038] The error-state outputting unit 26 notifies the plurality of remote IO
modules 3, via the CPU-state signal line 6, of an error state of the CPU module 2
that has been detected by the error-state detecting unit 25. For this, the CPUstate
signal line 6 uses a differential serial interface, such as RS-485 which
15 allows a multi-drop connection, as is the case with the serial transmission line 5.
The serial transmission line 5 is used for transferring data at predetermined
intervals, but the CPU-state signal line 6 is used to output an error state of the
CPU module 2 immediately after an error is detected.
[0039] Thus, providing the CPU-state signal line 6 separately from the serial
20 transmission line 5 allows for asynchronously communicating an error state of
the CPU, regardless of operation of the CPU transmitting unit 23 in the CPU
module 2, to quickly notify a CPU error.
In addition, the CPU-state signal line 6 can have small communication
capacity because it only needs to notify a CPU error, and a communication rate
25 can be smaller than that of the serial transmission line 5. This allows for
improving the reliability level of data transmitted via the CPU-state signal line 6.
[0040] Alternatively, the error-state outputting unit 26 may include a CPUstate
contact that converts state data detected by the error-state detecting unit
25 into a signal for driving the CPU-state signal line 6, and outputs the result to
30 the outside. In this case, the CPU-state contact can be configured with, for
example, a semiconductor relay or an electromagnetic relay. The CPU-state
contact may be set to a conducting state if the state data indicates that the CPU
13
is normal, or an insulated state if the state data indicates that the CPU is in
error.
In this case, if power supply to the CPU module 2 is discontinued, the CPUstate
contact transitions to an insulated state, and therefore discontinuance of
power supply is also outputted as a CPU error5 .
[0041] More specifically, power supply may have a voltage of, for example, AC
100 V, AC 200 V, DC 24 V, or DC 48 V, the contact may have specifications of a
conducting state and an insulated state, and the CPU-state signal line 6 may be,
for example, a two-wire cable, and this allows for outputting from the CPU
10 module 2 to the remote IO module 3 for sure whether there is any CPU error,
without any influence from external noises.
Alternatively, power supply may be a current source having a current of 4 to
20 mA, and the contact may have specifications of whether there is any current,
where the contact may be set, if the CPU is normal, to a state indicating that
15 there is a current.
[0042] FIG. 4 is a diagram showing an exemplary configuration of the remote
IO module 3 and the plant apparatus 4.
The remote IO module 3 includes a remote IO transmitting unit 31, an IO
inputting unit 36, an IO outputting unit 34, a CPU-error controlling unit 35,
20 which are mutually connected via a system bus 33. In addition, the IO inputting
unit 36 is connected with a state contact 41 of a controlling device 42 in the plant
apparatus 4 by an apparatus connection input cable 7-2, while the IO outputting
unit 34 is connected with an operation terminal 40 of the controlling device 42 of
the plant apparatus 4 by an apparatus connection output cable 7-1.
25 [0043] Here, the IO inputting unit 36, the IO outputting unit 34, and the CPUerror
controlling unit 35 within a broken line in FIG. 4 constitute a configuration
for one bit of digital data, and then, if the remote IO module 3 processes 16-bit
digital data DI, DO, the actual configuration will include 16 sets of the IO
inputting unit 36, the IO outputting unit 34, and the CPU-error controlling unit
30 35.
[0044] The remote IO transmitting unit 31 executes serial transmission to or
from the CPU module 2 via the serial transmission line 5 to send or receive the
14
digital data DI, DO. Here, digital data for serial transmission is composed of
multiple words, where 16 bits of digital data DI is defined as one word or 16 bits
of digital data DO is defined as one word, for example.
The remote IO transmitting unit 31 receives digital data DI corresponding to a
state of the state contact 41 from the IO inputting unit 36 via the system bus 335 ,
and then converts the digital data DI into digital data in a word format to
transmit the result to the CPU module 2.
In addition, the remote IO transmitting unit 31 extracts digital data DO
transmitted from the CPU module 2, and outputs the digital data DO to the IO
10 outputting unit 34 via a CPU-error controlling unit 35 connected to the system
bus 33.
[0045] The CPU-error controlling unit 35 is connected with the CPU-state
signal line 6 and is notified whether the CPU module 2 is normal or in error. The
CPU-error controlling unit 35 performes operation on IO output provided in the
15 remote IO module 3, using a normal or abnormal state of the CPU module 2 and
digital data DO inputted from the remote IO transmitting unit 31, and outputs
the operation result to the IO outputting unit 34.
In particular, control is made so that the IO outputting unit 34 outputs a state
corresponding to the digital data DO if notified that the CPU module 2 is normal,
20 while the IO outputting unit 34 outputs an insulated state if notified that the
CPU module 2 is in error.
[0046] The IO outputting unit 34 is connected to the operation terminal 40 of
the plant apparatus 4 via the apparatus connection output cable 7-1, and notifies
the operation terminal 40 in the plant apparatus 4 of a conducting state or an
25 insulated state in accordance with the setting of the CPU-error controlling unit
35. The plant apparatus 4 is controlled in such a way.
[0047] The IO inputting unit 36 is connected to the state contact 41 of the plant
apparatus 4 via the apparatus connection input cable 7-2, and obtains a
conducting state or an insulated state of the state contact 41. Then, the IO
30 inputting unit 36 sets the digital data DI to “1” if the state contact 41 indicates a
conducting state, and sets the digital data DI to “0” if the state contact 41
15
indicates an insulated state. The digital data DI set above is notified to the CPU
module 2 via the remote IO transmitting unit 31.
[0048] FIG. 5 is a diagram showing a configuration of a CPU-error controlling
unit 35.
The CPU-error controlling unit 35 includes a first input circuit 351, a 5 second
input circuit 352, and a logic operation circuit 353.
The first input circuit 351 is connected to the error-state outputting unit 26 in
the CPU module 2 via the CPU-state signal line 6 and converts a signal on the
CPU-state signal line 6 to the TTL (Transistor Transistor Logic) level. For
10 example, the signal on the CPU-state signal line 6 is converted into the Low level
if it indicates an error state of the CPU module 2, while it is converted to the
High level if it indicates a normal state of the CPU module 2.
[0049] The second input circuit 352 is connected to the system bus 33 and
converts the digital data DO received by the remote IO transmitting unit 31 to
15 the TTL level. For example, the digital data DO is converted to the Low level if it
is “0”, while it is converted to the High level if it is “1.”
The logic operation circuit 353 is, for example, a logic circuit configured with a
TTL, and executes logic operation on the signals from the first input circuit 351
and the second input circuit 352 to output a control output signal. The control
20 output signal is set to the High level if the operation result is “true,” while it is
set to the Low level if the operation result is “false.”
[0050] The logic operation circuit 353 of the embodiment includes a logical
product circuit, and outputs a control output signal as follows.
If the signal on the CPU-state signal line 6 indicates a normal state of the CPU
25 module 2 and the digital data DO is “1,” the output of the first input circuit 351 is
the High level and the output of the second input circuit 352 is also the High
level , and then the High level indicative of “true” is outputted as the control
output signal, as a result of the logical product by the logic operation circuit 353.
If the signal on the CPU-state signal line 6 indicates a normal state of the CPU
30 module 2 and the digital data DO is “0,” the output of the first input circuit 351 is
the High level and the output of the second input circuit 352 is the Low level ,
16
and then the Low level indicative of “false” is outputted as the control output
signal, as a result of the logical product by the logic operation circuit 353.
[0051] If the signal on the CPU-state signal line 6 indicates an error state of the
CPU module 2, the Low level indicative of “false” is outputted as the control
output signal, regardless of whether the digital data DO is “1” or “0,” as a resul5 t
of the logical product by the logic operation circuit 353.
[0052] FIG. 6 is a diagram showing a configuration of the IO outputting unit 34
of the remote IO module 3.
The IO outputting unit 34 includes a relay circuit 341 and an output-terminal
10 342.
The relay circuit 341 is configured, for example, with a semiconductor relay or an
electromagnetic relay, and turns on or off the circuit on the output side in
response to the control output signal of the CPU-error controlling unit 35. For
example, the circuit turns on the relay if the control output signal indicates the
15 High level, while the circuit turns off the relay if the control output signal
indicates the Low level.
The output-terminal 342 is connected to the operation terminal 40 of the plant
apparatus 4 by the apparatus connection output cable 7-1, and sets the operation
terminal 40 to a conducting state or an insulated state by the relay circuit 341.
20 [0053] FIG. 7 is an exemplary time chart of the CPU-error controlling unit 35 to
indicate the relationship between the CPU-state signal, the digital data DO, and
the control output signal.
While the signal on the CPU-state signal line 6 indicates a normal state, the
control output signal of High level is outputted if the digital data DO is “1,” and
25 the control output signal of Low level is outputted if the digital data DO is “0.”
Accordingly, the control output signal is outputted in response to the value of the
digital data DO to control the operation terminal 40 of the plant apparatus 4 so
as to have a conducting state or an insulated state.
On the other hand, while the CPU-state signal line 6 indicates an error state,
30 the control output signal of Low level is outputted regardless of whether the
digital data DO is “1” or “0.” Accordingly, if the CPU-state signal line indicates an
17
error state, the operation terminal 40 of the plant apparatus 4 is controlled to
have an insulated state.
[0054] Hereinabove, a description has been given of the CPU-error controlling
unit 35 configured to handle 1-bit digital data DO. However, if the remote IO
module 3 is configured to handle 16-bit digital data DO, the CPU-err5 or
controlling unit 35 in FIG. 5 will be configured to include sixteen second input
circuits 352 and sixteen logical product circuits in the logical product circuit 353
to output sixteen control output signals from the logical product circuit 353.
Further, if an error state of the CPU module 2 is notified via the CPU-state
10 signal line 6, all of sixteen IO outputting units 34 control the operation terminals
40 of the control apparatuses 4 connected so as to have an insulated state.
[0055] If the controller 1 has a plurality of remote IO modules 3, as shown in
FIG. 1, an error state of the CPU module 2 is notified to all the remote IO
modules 3, because the CPU-state signal line 6 is connected in a daisy-chain to
15 the plurality of remote IO modules 3. Each remote IO module 3 executes the
processing described above to control the operation terminal 40 of the control
apparatus 4 connected so as to have an insulated state. This allows for stopping
all the plant apparatuses to be controlled by the controller 1.
Second Embodiment
20 [0056] FIG. 8 is a diagram showing another configuration of the remote IO
module 3.
The remote IO module 3 includes the remote IO transmitting unit 31, a
transmission-error controlling unit 32, a plurality of sets of the IO inputting unit
36, the IO outputting unit 34, and the CPU-error controlling unit 35 which set is
25 provided for each plant apparatus 4 connected, which units are mutually
connected via the system bus 33. In addition, the IO inputting unit 36 is
connected with the state contact 41 of the plant apparatus 4 by the apparatus
connection input cable 7-2, and the IO outputting unit 34 is connected with the
operation terminal 40 of the plant apparatus 4 by the apparatus connection
30 output cable 7-1.
18
The remote IO module 3 of the present embodiment is different from that in
FIG. 4 in having the transmission-error controlling unit 32, and a description will
be given hereinbelow of the present embodiment, focusing on differences.
[0057] The transmission-error controlling unit 32 monitors transmission on the
serial transmission line 5, which connects the remote IO module 3 and 5 the CPU
module 2, via the remote IO transmitting unit 31 for every control cycle, to
control the remote IO transmitting unit 31, upon detecting a transmission error,
so that the digital data DO is modified according to a predetermined modification
rule.
10 Here, the transmission-error controlling unit 32 determines a transmission
error by detecting a disconnection such as a cable disconnection, a timeout which
indicates a condition that transmission or reception of data does not complete
within a predetermined time, or an error on the digital data in transmission such
as a CRC error and a parity error.
15 [0058] The modification rule, with which the transmission-error controlling
unit 32 modifies the digital data DO when detecting a transmission error for
every control cycle, includes, for example, rewriting the digital data DO to “0”
(zero-clear) and keeping the digital data DO as it has been before detecting the
error (hold).
20 [0059] The modification rule can be set for every bit of the digital data DO, in
other words, every plant apparatus 4 to be controlled. Accordingly, for the remote
IO module connected to the plant apparatus 4 having a plurality of operation
terminals, the CPU module 2 sets the modification rule by a command for each
digital data DO.
25 [0060] The digital data DO that has been modified in the remote IO
transmitting unit 31 at the transmission error is transmitted to the CPU-error
controlling unit 35.
The CPU-error controlling unit 35 modifies the digital data DO in response to
the state of the CPU-state signal line 6, as described above, to output the control
30 output signal to the IO outputting unit 34. The control output signal is converted
to a conducting state or an insulated state by the IO outputting unit 34 and
notified to the operation terminal 40 of the plant apparatus 4.
19
[0061] FIG. 9 is an exemplary time chart of the digital data DO outputted from
the remote IO transmitting unit 31. The chart shows the relationship between
the digital data DO inputted from the CPU module 2, the presence or absence of
a transmission error, and the output from the CPU-error controlling unit 35 by
the modification rule for digital data at the time of transmission error5 .
If any transmission error is not detected by the transmission-error controlling
unit 32 on the transmission cable 5, the digital data DO is outputted unmodified
from the remote IO transmitting unit 31 to the CPU-error controlling unit 35,
regardless of the setting of the modification rule for the digital data DO, and then
10 outputted as it is as far as there is no CPU error.
[0062] On the other hand, if a transmission error is detected, the digital data
DO outputted to the CPU-error controlling unit 35 differs depending on the
setting of the modification rule for the digital data DO. If the rule is set to “hold,”
the digital data DO is modified to the value as it has been before the
15 transmission error is detected (“1” in FIG. 9) and outputed to the CPU-error
controlling unit 35. If the rule is set to “zero-clear,” the digital data DO is
modified to "0" and outputted to the CPU-error controlling unit 35. Then, the
modified digital data DO is outputted from the remote IO module as far as there
is no CPU error.
20 Thus, setting the modification rule for the digital data DO for each plant
apparatus 4 allows for changing the way to react at the time of an error in
accordance with the importance of the plant apparatus 4, to improve the
reliability level of the system.
[0063] FIG. 10 is a flowchart of a program processing operation of the remote
25 IO module 3. The flow in FIG. 10 is operated in each of the plurality of remote IO
modules 3.
First, it determines whether the digital data DO of the remote IO module 3
itself has been received (S901). If the digital data DO addressing the remote IO
module 3 itself has not been sent from the CPU module 2, it keeps listening (No
30 in S901).
[0064] If the digital data DO addressing itself has been received (Yes in S901),
it determines whether there has been any transmission error while receiving the
20
data (S902). In particular, the transmission error is determined, for example, by
way of a parity check, a CRC code, or a checksum.
If there is no error (No in S902), it stores the received digital data DO
temporarily for a transmission error process to be described later, assuming that
the digital data DO has normally been transmitted (S909), and then proceeds 5 to
S906.
[0065] If there has been a transmission error (Yes in S902), it modifies the
digital data DO as follows.
First, it determine the set modification rule (S903), and if the rule is
10 determined to be “zero-clear” (“zero-clear” in S903), it rewrites the digital data
DO to zero (S904), and then proceeds to S906.
If the rule is determined to be “hold” in S903 (“hold” in S903), it rewrites the
digital data DO to the value of the normal transmission of the preceding digital
data DO which has temporarily been stored in S909 (S905). That is, it proceeds to
15 S906 after rewriting the digital data DO to the value as it has been before an
error is detected.
[0066] In S906, it determines whether any notification of a CPU error from the
CPU module 2 has been detected. If it detects a CPU error (Yes in S906), it
unconditionally rewrites the digital data DO to zero (S907), and proceeds to S908.
20 If any notification of an CPU error has not been detected in S906 (No in S906),
it proceeds to S908.
In S908, it arranges the digital data DO to the IO outputting unit 34 to output
a conducting state or an insulated state according to the value of the digital data
DO.
25 [0067] According to the flow as described above, upon detecting an occurrence of
a transmission error on the serial transmission line 5 and/or a malfunction of the
CPU module 2, the digital data DO is modified to prevent abnormal control of the
controller 1.
Further, the processing for an error in the CPU module can be executed
30 asynchronously from the process in FIG. 10, in order to quickly execute corrective
action for an error in the CPU module 2.
21
[0068] FIG. 11 is a flowchart of processing a CPU error to be executed
asynchronously.
Processing in FIG. 11 is desirably started by an interruption of receiving data
on the CPU-state signal line 6, having the interrupt priority level as high as
possibl5 e.
Note that the processing in S906, S907, S908 in FIG. 11 is the same as that in
FIG. 10, and therefore a description thereof will be omitted.
Third Embodiment
[0069] Next, a description will be given of a specific example of a modification
10 rule for the digital data DO to be processed by the transmission-error controlling
unit 32, with reference to FIG. 12.
FIG. 12 is a diagram showing an exemplary water transport plant that pumps
stored water in a pump well 8 to control the flow rate at a target rate for
discharging the water as effluent water from a pipe 9.
15 The water transport plant is configured to include the pump well 8, the pipe 9,
a fixed-speed pump 42a, an electric valve 42b for regulating the flow rate, and a
flow meter 42c. The effluent water discharged by the fixed-speed pump 42a is
measured by the flow meter 42c to obtain the flow rate, and controlled by the
electric valve 42b so as to have a constant flow rate.
20 [0070] In the water transport plant, a plant apparatus 4a inclusive of the fixedspeed
pump 42a, a plant apparatus 4d inclusive of the electric valve 42b, and a
plant apparatus 4g inclusive of the flowmeter 42c are connected to remote IO
modules 3a, 3b, 3c, respectively, via apparatus connection cables 7a, 7d, 7e , 7g,
and the CPU module 2 controls the flow rate. The remote IO modules 3a, 3b, 3c
25 are connected in a daisy chain to the CPU module 2 via the serial transmission
line 5 and the CPU-state signal line 6.
Next, function of the plant apparatuses 4a, 4d, 4g will be described.
[0071] The fixed-speed pump 42a in the plant apparatus 4a has specification of
a constant rotational speed, to discharge water at a constant flow rate when
30 operated and to discharge water at a flow rate of zero when stopped. The plant
apparatus 4a includes an operation terminal 40a, and the operation terminal 40a
22
is electrically made in a conducting state to continue pumping operation and in
an insulated state to stop the pumping operation.
[0072] The electric valve 42b in the plant apparatus 4d regulates opening or
closing the valve by the forward or reverse rotation of the motor, to control the
discharge flow rate from the fixed-speed pump pump 42a. The degree of openi5 ng
the valve ranges from, for example, 0 % to 100 %, where 0 % indicates a fullyclosed
state and 100 % indicates a full-open state. The degree of opening the
valve is set by controlling the opening time and the closing time of the valve.
In particular, assuming that the opening or closing the valve has, for example,
10 an opening rate of 5 % per second, if opening is kept for 20 seconds in the fullyclosed
state, the valve reachs a fully-open state and the opening is stopped.
Conversely, if closing is kept for 20 seconds in a fully-open state, the valve
reaches a fully-closed state and the closing is stopped.
The plant apparatus 4d includes an operation terminal 40b (opening) and an
15 operation terminal 40c (closing), and the operation terminals 40b or 40c is
electrically made in a conductive state to continue opening or closing , and in an
insulated state to stop the opening or the closing.
The degree of opening the electric valve 42b in the plant apparatus 4d is
controlled to have the desired degree of opening by regulating the time to make
20 the operation terminal 40b or the operation terminal 40c in a conducting state.
[0073] The flow meter 42c of the plant apparatus 4g measures the flow rate of
the effluent water being diffused.
The analog output terminal 43 of the plant apparatus 4g converts the
measured value of the flow rate to a current signal of 4 to 20 mA to output.
25 [0074] The CPU module 2 executes a control program that obtains the flow rate
of the effluent water from the analog output terminal 43 as analog input data AI
via the remote IO module 3c, to regulate starting and stopping the fixed-speed
pump 42a as well as opening and closing the electric valve 42b, so that the analog
input data AI meets the target flow rate.
30 The control program records a starting or stopping instruction in the digital
data DO so as to be set in the operation terminal 40a of the plant apparatus 4a
via the remote IO module 3a to start or stop the fixed-speed pump 42a.
23
The control program records opening and closing instructions in the digital
data DO so as to be set in the operation terminals 40b, 40c of the plant apparatus
4d via the remote IO module 3b to set the level of opening the electric valve 42b.
[0075] As described above, the remote IO modules 3a, 3b each detect a
transmission error on the serial transmission line 5, through which the digita5 l
data DO is transferred, to modify the digital data DO based on a predetermined
modification rule.
In the present embodiment, the digital data DO is modified for the fixed-speed
pump 42a and the electric valve 42b, if a transmission error is detected, based on
10 the following modification rules.
[0076] The modification rule in the remote IO module 3a is set to hold the
digital data DO for instructing the fixed-speed pump 42a on operation in a state
set in the preceding control cycle. In other words, the rule is to maintain the
current state of the fixed-speed pump 42a such as being active or inactive.
15 [0077] The modification rule in the remote IO module 3b is set to clear the
digital data DO for instructing opening or closing the electric valve 42b (to
prevent opening or closing). In other words, the rule is to stop opening or closing
the electric valve 42b to fix the level of opening the valve so as to maintain the
current flow rate.
20 [0078] The modification rules for the digital data DO at the time of
transmission error are set as described above for the fixed-speed pump 42a and
the electric valve 42b of the water transport plant according to the present
embodiment, to allow for transporting water without any interruption even in the
control cycle where a transmission error is detected, and also for resuming the
25 control easily when the transmission is restored to normal.
The modification rules described above are not fixed thereto, and can be
determined as appropriate according to the operational specifications at the time
of a transmission error.
[0079] Incidentally, in the controller 1 according to the present embodiment for
30 the water transport plant, shown in FIG. 12, the CPU module 2 notifies the
remote IO modules 3a, 3b, 3c of a CPU error via the CPU-state signal line 6.
24
The remote IO modules 3a, 3b, 3c, which are notified of the CPU error via the
CPU-state signal line 6, makes the digital data DO “0” to set the operation
terminals 40a, 40b, 40c in an insulated state. In other words, the fixed-speed
pump 42a stops pumping operation and the electric valve 42b stops opening or
closing the valve, to cause diffusion of the effluent water to be stopped5 .
[0080] If a CPU error is detected, it may take time before the controller is
restored. Then, the fixed-speed pump 42a and the electric valve 42b are desirably
be operated manually in order to diffuse the effluent water.
[0081] For this reason, the device connection cable 7a of the operation terminal
10 4a of the fixed-speed pump 42a may be, for example, arranged with a switching
device so that a signal from the remote IO module 3a and a signal from the
manual operation device can be selected.
If the fixed-speed pump 42a is stopped due to a CPU error, the switching
device is switched to connect the operation terminal 4a of the fixed-speed pump
15 42a with the manual operation device. Then, the operation terminal 4a of the
fixed-speed pump 42 can be made in a conducting state by the manual operation
device, to resume pumping operation.
[0082] As described above, the present embodiment allows the controller 1,
upon detecting a critical condition of an error in the CPU module 2, to securely
20 make the apparatus connection output cable 7-1 be in an insulated state to stop
operation of all the plant apparatuses, and then to prevent a malfunction of the
plant.
In addition, the present embodiment allows for securely stopping operation of
the plant at the time of a CPU error only by implementing a simple logic circuit
25 in the remote IO module, not by way of such as a high-performance CPU, and
laying a signal cable for notifying the state of the CPU module, to have
advantageous effects of improving safety at a low cost.
[0083] Further, there is an advantageous effect that, if the CPU module 2 is
normal, continuing or stopping the output to the controlling devices can
30 selectively be set when a transmission error is detected on the serial
transmission line 5, and this allows for flexibly reacting to an error, even if it
25
occurs, according to the importance and operation policy of the plant apparatus to
be controlled.
Furthermore, the operation of all the controlling devices connected are stopped
only if specific critical errors such as a CPU error are detected, and this allows
for improving an operating rate of the automatic control to expectedly reduce 5 e the
operator’s burden of manual operation.
[0084] The controller of the present invention is not limited to the embodiments
described above, and can be appropriately modified without departing from the
scope of the present invention. Hereinbelow, other embodiments of a controller
10 according to the present invention will be listed.
In the embodiments described above, the remote IO module 3 is configured to
include one DI and one DO, but may be configured to include a plurality of DI
and a plurality of DO, or may be configured to include a plurality of AI, AO, and
PI.
15 [0085] In addition, in the embodiment described above, the state contact, the
operation terminal, and the CPU-state contact are normally-open, but can be
normally-closed or combinations of the two.
Further, the controller 1 according to the embodiments described above can be
applied to a controller in a social infrastructure system such as a power system, a
20 gas system, a transportation system, and a dam system, or a controller in an
industrial system such as a steel system, a chemical system, a food system, and a
distribution system.
Furthermore, information such as programs for achieving respective functions
and data can be in, other than a RAM (Random Access Memory), a recording
25 device such as an SSD (Solid State Drive) or a recording medium such as an IC
(Integrated Circuit) card, a SD (Secure Digital) card, and a DVD (Digital
Versatile Disc).
[0086] Moreover, the component, the function, the CPU, the memory, and the
system bus of each portion according to the embodiment described above can also
30 be implemented, in part or as a whole, in hardware designed in an integrated
circuit.
26
Note that only control lines and information lines which may possibly be
required for describing the embodiments are indicated in the drawings, and all
control lines and information lines of the products are not necessarily indicated.
In fact, almost all components can be considered as being connected to one
another5 .
LEGEND FOR REFERENCE NUMERALS
[0087] 1 Controller;
2 CPU module;
3, 3a, 3b, 3c Remote IO module;
10 4, 4a, 4b, 4c, 4d, 4e, 4f, 4g, 4h, 4i Plant apparatus;
5 Serial transmission line;
6 CPU-state signal line; and
7a, 7b, 7c, 7d, 7e, 7f, 7g, 7h, 7i Apparatus connection cable.

WE CLAIM:
1. A controller for controlling plant apparatuses, comrising:
a CPU module that has an error-state detecting unit for detecting a
malfunction of a module, and program-controls a plurality of plant
apparatuses in the plant; a5 nd
a plurality of remote IO modules that are connected in a daisy-chain to
the CPU module by a serial transmission line, and convert digital
data transmitted from the CPU module to output the results to the
plurality of plant apparatuses,
10 wherein the CPU module, when the error-state detecting unit detects a
malfunction, notifies the plurality of remote IO modules of a CPU error, and
the plurality of remote IO modules, when notified of the CPU error, make all
the plurality of plant apparatuses in inactive states, separately from the control
using the digital data.
15 2. The controller according to claim 1, wherein
the CPU error is notified from the CPU module to the plurality of remote IO
modules via a signal cable that connects in a daisy-chain the CPU module and
the plurality of remote IO modules, separately from the serial transmission line.
3. The controller according to claim 1, wherein
20 the plurality of remote IO modules obtain logical products of the CPU error
and the digital data to output operation results to the plurality of plant
apparatuses.
4. The controller according to claim 1, wherein
each of the plurality of remote IO modules includes a transmission-error
25 controlling unit that detects a transmission error and modifies digital data,
wherein the transmission-error controlling unit, upon detecting a transmission
error, modifies digital data based on predetermined modification rules for every
plant apparatus connected.
5. The controller according to claim 4, wherein
30 the modification rule is either to rewrite the digital data to “0” (zero-clear) or to
keep the digital data as it has been before detecting the error (hold).
6. A controller comrising:
28
a CPU module; and
a plurality of remote IO modules that control a plurality of plant
apparatuses in a plant,
wherein the CPU module and the plurality of remote IO modules are connected
via5 :
a serial transmission line that connects in a daisy chain the CPU module and
the plurality of remote IO modules, and is used for transmitting control
information; and
a CPU state signal line that connects in a daisy-chain the CPU module and the
10 plurality of remote IO modules, and is used for transmitting a CPU error from
the CPU module to the plurality of remote IO modules.
7. The controller according to claim 6, wherein
control information is cyclically transmitted on the serial transmission line,
and
15 CPU-state information is transmitted on the CPU-state signal line,
asynchronously with the serial transmission line.
8. The controller according to claim 6, wherein
the CPU-state information has less data amount than the control information
which is transmitted on the serial transmission line.
20 9. A control method for a controller that includes a CPU module and a
plurality of remote IO modules, each controlling at least one plant apparatus in a
plant, and controls a plurality of plant apparatuses in the plant,
the control method comprising:
a step of detecting a malfunction of the CPU module that program25
controls the plurality of plant apparatuses in the plant for outputting
on the CPU-state signal line a signal indicating an error state; and
a step of setting all the operation terminals, by the plurality of remote IO
modules that set respective operation terminals of the plurality of
plant apparatuses in response to digital data DO which has been
30 notified from the CPU module, in a predetermined state according to
a signal indicating an error state via the CPU-state signal line.
10. The control method according to claim 9, further comprising:
29
a step of monitoring, by the plurality of remote IO modules, a serial
transmission line that connects the CPU module and the plurality of
remote IO modules at a predetermined control cycle, and when a
transmission error is detected, modifying the digital data DO notified
from the CPU module according to a predetermined modification rul5 e
for setting the operation terminal.
11. The control method according to claim 10, wherein
a timing when the plurality of remote IO modules set the operation terminals
in response to the digital data DO from the CPU module is different from a
10 timing when the plurality of remote IO modules set the operation terminals in
response to a signal on the CPU-state signal line indicating an error state.
12. The control method according to claim 10, wherein
the plurality of remote IO modules process the step of setting the operation
terminals according to a signal on the CPU-state signal line indicaing an error
15 with a higher priority than a step of modifying the digital data DO notified from
the CPU module according to the predetermined rule for setting the operation
terminals.