WO2011074147A1

WO2011074147A1 - Redundant control device

Info

Publication number: WO2011074147A1
Application number: PCT/JP2010/002917
Authority: WO
Inventors: 飯田烈弘
Original assignee: 三菱電機株式会社
Priority date: 2009-12-16
Filing date: 2010-04-22
Publication date: 2011-06-23
Also published as: TWI434159B; CN102656528A; TW201122745A; JPWO2011074147A1

Abstract

Disclosed is a redundant control device, comprising a control assembly (A) further comprising an auto-diagnostic function; and another control assembly (B), further comprising an auto-diagnostic function, and which is made redundant with the control assembly (A). When one of the two control assemblies operates in an actual control assembly mode upon an object to be controlled, the other control assembly operates in an assembly mode that carries out auto-diagnostics, and the actual control assembly and the assembly carrying out auto-diagnostics are mutually interchanged such that both assemblies respectively carry out auto-diagnostics and diagnose regions whereupon auto-diagnostics could not otherwise be carried out when operating in control assembly mode.

Description

Dual system controller

The present invention relates to a plant control device used in, for example, a power plant.

Generally, in a conventional standby redundant configuration plant control apparatus, a self-diagnosis is performed to detect an abnormality of the control apparatus. This self-diagnosis is performed by making a judgment based on an abnormality of the hardware or software of the own system, an upper / lower limit error of the input signal, an abnormality of the calculation result, or the like. In particular, in a control device having a duplex configuration, as shown in FIG. 10, system switching is generally performed when an abnormality is detected in any of the duplex control systems. Patent Document 1 describes a dual system control device based on such a switching condition (for example, Patent Document 1).

JP-A-8-123503 (page 3, FIG. 2)

In conventional dual system control devices, since self-diagnosis is performed while controlling the plant, there is a problem that areas such as main memory where self-diagnosis cannot be performed remain, and that location can only be diagnosed offline during regular maintenance. there were.

The present invention has been made to solve the above-described problems, and even during control, it is possible to diagnose a region where conventional self-diagnosis was not possible, and to shorten the self-diagnosis cycle. An object of the present invention is to provide a dual system control device with a high safety level.

The dual system control device according to the present invention is a control device having a duplex configuration including a control system having a self-diagnosis function and another control system that is duplexed with the control system and has a self-diagnosis function, When one of the two control systems operates as an actual control system, the other operates as a system that performs self-diagnosis, the system that performs actual control and the system that performs self-diagnosis are alternately switched, and both systems alternate. Self-diagnosis is performed.

In the dual system control apparatus according to the present invention, when one of the two control systems operates as a real control system, the other operates as a system that performs self-diagnosis, and performs self-diagnosis with a system that performs actual control. Since the systems are alternately switched and the two systems alternately perform self-diagnosis, it is possible to perform self-diagnosis of the area, which could conventionally be diagnosed only offline, during operation of the entire system. As a result, the range of self-diagnosis is expanded and the period of self-diagnosis can be shortened, so that the safety level is improved.

It is a schematic block diagram in Embodiment 1 of the dual-system control apparatus concerning this invention. It is a conceptual diagram which shows the operation | movement outline | summary in Embodiment 1 of the dual-system control apparatus concerning this invention. It is a flowchart in Embodiment 1 of the dual-system control apparatus concerning this invention. It is a schematic block diagram of the dual system control apparatus in Embodiment 2 of the dual system control apparatus concerning this invention. It is a conceptual diagram which shows the operation | movement outline | summary in Embodiment 2 of the dual-system control apparatus concerning this invention. It is a flowchart in Embodiment 2 of the dual-system control apparatus concerning this invention. It is a flowchart in Embodiment 3 of the dual-system control apparatus concerning this invention. It is a flowchart in Embodiment 4 of the dual-system control apparatus concerning this invention. It is a flowchart in Embodiment 5 of the dual-system control apparatus concerning this invention. It is a conceptual diagram which shows the operation | movement outline | summary in the conventional dual type | system | group control apparatus.

Embodiment 1 FIG.
Hereinafter, a dual system control apparatus according to a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a schematic configuration diagram of a dual system control apparatus according to Embodiment 1 of the dual system control apparatus according to the present invention. In FIG. 1, the dual system control device is configured in a duplex manner by a system A that is a control system and a system B that is another control system. These control systems A and B are respectively connected to the CPUs 1A and 1B for performing arithmetic processing and the like,

memories

2A and 2B connected to these CPUs, and the respective CPUs, and input information from the control target is input to these control systems A and B. Input control units 3A and 3B that transmit to the CPU and

output control units

4A and 4B that control output information to the output control device 7 are provided. By connecting the input control units 3A and 3B and the

output control units

4A and 4B to the switching device 5 that performs system switching by a system switching instruction signal, output information of either the A system or the B system is not illustrated. Output to the controlled object via the output device 7, and input information from the controlled object is input to either the A system or the B system via the input device 6.

Next, the operation of the dual system control device will be described. FIG. 2 is a conceptual diagram showing an outline of operation in the first embodiment of the dual control apparatus according to the present invention. In FIG. 2, for the sake of convenience, the A system is a system that performs actual control at the time series start point (hereinafter referred to as an actual control system), and the B system is a system that performs self diagnosis at the time series start point (hereinafter referred to as a self diagnosis system). The actual control or self-diagnosis is performed. As shown in FIG. 2, in the first embodiment, system switching is performed at the same time. FIG. 3 is a flowchart showing in detail the operation of both the A and B systems. Hereinafter, a description will be given with reference to FIG. As in FIG. 2, for convenience, the A system will be described as an actual control system at the start, and the B system will be described as a self-diagnosis system at the start. When the A system performs a series of controls as an actual control system (S01), the B system performs a self diagnosis as a self diagnosis system (S03). Upon confirming the completion of the self-diagnosis of the own system (S05), the B system issues a system switching instruction (S06), and system switching is performed (S02 and S04). On the other hand, when the system A, which is the actual control system, confirms the system switching instruction (S07), switching is performed (S02 and S04), and the system A starts self-diagnosis as a self-diagnosis system (S03). Starts actual control as an actual control system (S01).

In this way, the actual control system and the self-diagnosis system are alternately switched, and both the A and B systems perform self-diagnosis alternately. Can be implemented during operation. As a result, the range of self-diagnosis is expanded and the period of self-diagnosis can be shortened, so that the safety level is improved.

Embodiment 2. FIG.
Hereinafter, a second embodiment of the dual control apparatus according to the present invention will be described with reference to the drawings, focusing on parts different from the first embodiment. FIG. 4 is a schematic configuration diagram of a dual system control apparatus according to the second embodiment. In addition to the configuration of the first embodiment, a data communication line 8 connected between the CPUs 1A and 1B is provided. The diagnosis status of the self-diagnosis system is referred to between the A and B systems via this data communication line. The self-diagnosis system sets a flag as “diagnosis completed” when the diagnosis is completed, and “diagnostic” when the diagnosis is being performed.

Next, the operation of the dual system control device will be described focusing on the differences from the first embodiment. FIG. 5 is a conceptual diagram showing an outline of the operation in the second embodiment of the dual control apparatus according to the present invention. The first difference from FIG. 2 is that the actual control system refers to the state of the self-diagnosis system. The second difference is that when the self-diagnosis system completes the self-diagnosis, it stands by. The third difference is that the system is switched when the actual control system completes a series of control processes and refers to the state of the self-diagnosis system, and the self-diagnosis system is on standby. These differences will be described in detail below with reference to FIG. FIG. 6 is a flowchart in the second embodiment of the dual control apparatus according to the present invention. The A system starts a series of control processes as an actual control system (S01), and the B system starts a self diagnosis as a self diagnosis system (S03). When the series of control processing is completed, the A system refers to the diagnosis status of the B system (S201). If the diagnosis is in progress, the system switching is not performed and the control processing is continued sequentially (S01). On the other hand, when the self-diagnosis is completed, the B system waits until there is a system switching instruction (S203). The system A completes a series of control processing, refers to the diagnosis state of the system B (S201), and if the diagnosis is completed, issues a system switching instruction (S202) and performs system switching (S02 and S04). Thereafter, the A system starts as a self-diagnosis system (S03). On the other hand, the B system receives an instruction for system switching (S203), and when system switching (S02 and S04) is performed, actual control is started as an actual control system (S01). As a result, as in the first embodiment, system switching is repeatedly performed, and the A system and the B system perform self-diagnosis alternately.

In this way, even if the actual control system issues a system switching instruction, the intended purpose can be achieved, and system switching can be performed without affecting the control sequence.

Embodiment 3 FIG.
Hereinafter, a dual system control device according to a third embodiment of the present invention will be described with reference to the drawings, centering on differences from the second embodiment. FIG. 7 is a flowchart in the third embodiment of the dual control apparatus according to the present invention. The difference from FIG. 6 is that when the self-diagnosis system detects an abnormality by self-diagnosis, the abnormality is notified to the actual control system. That is, the B system that performs the self-diagnosis as the self-diagnosis system issues an abnormality notification to the A system that is the actual control system via the data communication line 8 when the abnormality of the own system is detected by the self-diagnosis (S302). (S303). The system A completes a series of control processes and refers to the operating state of the system B, but if an abnormality is detected, the system switching instruction is not performed and the control processes are continued sequentially (S01). When the abnormality is resolved in the B system, the self diagnosis is performed again (S03). When the B system confirms normality by self-diagnosis (S302), it waits until there is a system switching instruction (S203). On the other hand, when the series of control processing is completed, the A system refers to the operating state of the B system (S301). When the operation state of the B system is normal, the diagnosis state of the B system is referred to (S201). When the diagnosis is completed, a system switching instruction is issued (S202), and the system switching (S02 and S04) is performed. Thereafter, self-diagnosis is started as a self-diagnosis system (S03). The standby B system receives the system switching instruction (S203), and after system switching (S02 and S04) is performed, actual control is started as the actual control system (S01). As a result, even if an abnormality occurs in the self-diagnosis system, the system switching is repeatedly performed as in the second embodiment, and the A system and the B system perform self-diagnosis alternately.

This configuration and operation can achieve the intended purpose, and even if a failure occurs in the self-diagnosis system, the entire system can be operated continuously.

Embodiment 4 FIG.
Hereinafter, a dual system control device according to a fourth embodiment of the present invention will be described with reference to the drawings, focusing on differences from the third embodiment. FIG. 8 is a flowchart in the fourth embodiment of the dual control apparatus according to the present invention. The difference from FIG. 7 is that the self-diagnosis system can issue a system switching instruction by interrupt processing. That is, the B system that performs self-diagnosis as the self-diagnosis system refers to the operation state of the A system that is the actual control system via the data communication line 8 in parallel with the self-diagnosis process by the interrupt process (S401) ( S402). In the case of an abnormality, the B system stops the self-diagnosis process, issues a system switching instruction (S403), and after system switching (S02 and S04) is performed, actual control is started as the actual control system (S01). When the abnormality is resolved, the system A starts as a self-diagnosis system (S03), and after system switching (S02 and S04) is performed through the same steps (S302, S203) as in the third embodiment. As a real control system, a series of control is started (S01). As a result, as in the third embodiment, system switching is repeated, and both A and B systems perform self-diagnosis alternately.

This configuration and operation can achieve the intended purpose, and even if a failure occurs in the actual control system, the entire system can be operated continuously.

Embodiment 5 FIG.
Hereinafter, a fifth embodiment of the dual control apparatus according to the present invention will be described with reference to the drawings, focusing on parts different from the fourth embodiment. FIG. 9 is a flowchart in the fifth embodiment of the dual control apparatus according to the present invention. The difference from FIG. 8 is that the actual control system transmits the past input / output information sent and received and the current own resource information (hereinafter referred to as control information) to the self-diagnosis system immediately before the system switching. It is a point to do. That is, the system A, which is the actual control system, transmits control information to the system B via the data communication line 8 before the system switching instruction (S501), and issues a system switching instruction (S202). On the other hand, the system B, which is a self-diagnosis system, receives control information (S502). After completion of reception, system switching is performed (S02 and S04), the A system starts self-diagnosis as a self-diagnosis system (S03), and the B system starts actual control as an actual control system (S01). As a result, as in the fourth embodiment, system switching is repeatedly performed, and both A and B systems perform self-diagnosis alternately.

This configuration and operation can also achieve the intended purpose, and the B system has the effect of being able to continuously control the controlled object as a control system having the same contents as the A system.

It should be noted that the embodiment of the present invention is not limited to the above-described embodiments, and it is needless to say that various modifications can be made without departing from the gist of the present invention.

Claims

A control system having a self-diagnosis function;
This control system is duplicated with this control system, and is equipped with another control system having a self-diagnosis function.
When one of the two control systems operates as a system that performs actual control of the controlled object, the other operates as a system that performs self-diagnosis, and the system that performs actual control and the system that performs self-diagnosis are alternately switched, and both systems Dual system control device that performs self-diagnosis alternately.
The dual system control device according to claim 1, wherein the system performing the self-diagnosis performs system switching when the self-diagnosis is completed.
Between the two control systems, a data communication line for sending and receiving a diagnostic state is provided,
The system that performs the actual control refers to the self-diagnosis state of the system that performs the self-diagnosis via the data communication line, completes a series of control of the system that performs the actual control, and performs the self-diagnosis. The dual system control device according to claim 1, wherein the system switching is performed when the self-diagnosis is completed.
The system that performs the self-diagnosis, when an abnormality is found in the self-diagnosis, notifies the system that performs the actual control via the data communication line, and performs the actual control that has received the notification. 4. The dual system control device according to claim 3, wherein when the abnormality is confirmed, control of the controlled object is continued without performing the system switching.
The system performing the self-diagnosis refers to the system that performs the actual control via the data communication line. When an abnormality is detected in the system that performs the actual control, the self-diagnosis is stopped and the system switching is performed. The dual system control device according to claim 3.
The system performing the self-diagnosis refers to the system that performs the actual control via the data communication line. When an abnormality is detected in the system that performs the actual control, the self-diagnosis is stopped and the system switching is performed. The dual system control device according to claim 4.
Between the two control systems, a data communication line is provided for transmitting and receiving the control target and the past input / output information of the system that performs the actual control and the current resource information of the system that performs the actual control. ,
The duplex system according to any one of claims 1 to 6, wherein the system that performs the actual control transmits information necessary for the control to the system that performs the self-diagnosis via the data communication line. Control device.