JP2000066912A - Method for changing data of triple fault tolerant system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize a multiple system data changing method capable of making the good use of the merits of a multiple system without losing the redundancy of plant control and delaying the detection/generation of an alarm. SOLUTION: In this triple fault tolerant system, 1st to 3rd units 10, 20, 30 are connected side by side and after plant data for respective systems which are periodically inputted from the I/O parts 15, 25, 35 of the respective units 10, 20, 30 are operated by respective control operation parts 13, 23, 33, the operation results of the respective systems are processed by a majority and the processed results are periodically outputted to the operation systems of the plant. In this case, the I/O parts 15, 25, 35 of the 1st to 3rd units 10, 20, 30 are mutually connected by a data changing synchronizing signal line 40 and after receiving changed data from an external man-machine interface 50, each of the units 10, 20, 30 outputs a synchronizing signal to all the units 10, 20, 30 through the synchronizing signal line 40 to synchronize all the units 10, 20, 30 and to change control data based on the changed data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fault-tolerant system in which control devices are provided in an overlapping manner in order to reduce the downtime when a control device fails, and in particular, three control devices are connected in parallel. The present invention relates to a data change method that enables data change of a triple fault tolerant system at the same time.

[0002]

2. Description of the Related Art Generally, a control device of a plant receives process data from the plant, executes a control calculation based on a predetermined control law, and outputs the control calculation result to the plant. In such a plant control device, a fault-tolerant system that uses a plurality of control systems in an overlapping manner is used so that the normal operation of the plant can be maintained even if the control device goes down.
Further, an optimum signal (an intermediate value for analog data, a majority value for digital data) is selected from the input signals obtained by the sensors of the respective control systems and used for control calculation, and the respective control signals are controlled. A multi-fault fault-tolerant system that performs a majority process so that an optimum one is selected from the calculation results and can be used for plant control is used.

As one of the multiple fault tolerant systems, the present inventors have previously described a triple fault tolerant system (hereinafter, referred to as a triple system) including three control systems as a system used for gas turbine power generation control. (Japanese Patent Application No. 8-164529)
issue).

In this triple system, as shown in FIG. 4, each control system has a detecting section 52 composed of a sensor 51 for detecting process data of a plant, and a system section (unit) for controlling and calculating the detected value. 53 and an actuator 54 for operating the plant based on the calculated value
And an operation terminal 55 connected to the control unit 5. The system unit (unit) 53 includes an input unit 56, a control operation unit 5
7 and an output unit 58. The control operation unit 57 is configured by a CPU (59) that executes a control operation, and each control system can control the plant.

Further, each input section 56 and each control operation section 57 are so arranged that an input signal inputted to the input section 56 of each system section (unit) 53 can be taken into the CPU (59) of another control operation section 57. Are connected to each other via a V bus transmission line 60 of the VME bus system, and a selection unit 61 for selecting an input signal is provided on the input side of each control operation unit 57. In addition, a selection unit 63 for selecting a calculation result is provided on the output side of each control calculation unit 57 so that the calculation result of each control calculation unit 57 can be output to another output unit 58. Control operation unit 5
7 and each selector 61 are connected to each other via another V bus transmission line 62 of the VME bus system.

Although not shown, each system unit (unit) 53 has a function of mutually transferring an input signal or an operation result between the system units (units) 53 and a function of transferring the data between the system units (units) 53. A VBUS board having a function of exchanging synchronization signals is provided,
The CPU (59) is mounted on a general-purpose CPU board compatible with at least the VME bus, and the general-purpose CPU board and the VBUS board are mutually connected via the VME bus. Furthermore, the VBU of each system unit (unit) 53
The S boards are mutually connected by a V bus transmission line 60 dedicated to data transfer and synchronization.

The general-purpose CPU board is capable of generating a control operation cycle for a control operation cycle with a hardware counter, a software counter, and the like, and for periodically resetting or presetting the count value of the counter. Are exchanged between the system units (units) so that the start timings of the control operation cycle are simultaneously made, so that all system units (units) can be synchronized.

With these configurations, the control calculation unit 57 of each control system performs majority processing on the data of each control system during calculation while performing synchronization, selects the most likely data, and performs calculation and output. In addition, if the deviation of the data of each control system is greater than a set value, a warning is issued as a system abnormality.

Conventionally, when parameters of internal process data and control logic used for control operation of this triple system are changed by an external MMI (man-machine interface), the control operation is performed by each control system in order to perform majority processing. Must be changed in synchronization with the MM
Since the change data is sequentially input to each unit from I,
If the control operation cycle is as short as 10 msec.MIN, for example, as shown in FIG.
The data of each control system cannot be changed at the same time, and therefore, means must be used to exclude the data input at the time of data change from the majority decision.

[0010]

However, if the corresponding data is excluded from the majority decision, the redundancy of the data is lost, and the advantages such as the redundancy and reliability of the multiplex system cannot be used to the utmost. There was a problem.

For this reason, taking into account the time lag of data change between units, the alarm output is delayed until the data change of all units is completed and the data can be used to determine a system abnormality. However, in this case, there is a problem that the alarm output when an actual abnormality occurs is delayed.

SUMMARY OF THE INVENTION An object of the present invention is to provide a data change system for a multi-system capable of taking advantage of the multi-system without losing the redundancy of plant control and without delaying detection and generation of alarms. It is to provide a method.

[0013]

According to a first aspect of the present invention, there is provided a system wherein first to third units are connected side by side, and each system is periodically inputted from an input / output unit of each unit. In the triple system fault tolerant system in which the majority of the plant data is processed by the control operation unit, the operation result of each system is subjected to the majority processing, and the processed result is periodically output to the operation system of the plant. The input / output units are connected to each other by a data change synchronization signal line. When each unit receives change data from an external man-machine interface, a synchronization signal is output to all units for diagnosis of the synchronization signal line. After all units have received the synchronization signal, output the received signal to the man-machine interface, and the man-machine interface When received, a data change command is output to all units. When the data change command is received by all units, a synchronization signal is output from the first unit to all units via the synchronization signal line at the next cycle. ,
In this method, control data is changed by inputting the change data at the timing when all units receive the synchronization signal in the next cycle.

According to the above configuration, the change data externally input to the first unit, the second unit, and the third unit are temporarily held in the control operation unit of each unit, and then are synchronized for data change. The three units are synchronized via signal lines, and change data is input at the same timing to change control data. As a result, redundancy is maintained when the control data is changed.

[0015]

Next, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

The triple system according to the present invention, like the conventional system, includes a detecting section for detecting process data (plant data) of a plant, a system section (unit) for controlling and calculating the detected process data, and The operation unit is configured to operate the plant based on the operation value, and only this system unit (unit) is different from the conventional configuration.

FIG. 1 is a schematic diagram of a system section of a triple system according to the present invention.

As shown in FIG. 1, the system unit of the triple system according to the present invention comprises three units, a first unit 10, a second unit 20, and a third unit 30,
All units 10 including the first unit 10 and the own unit,
And a data change synchronization signal line 40 provided between the data change synchronization signal lines 20 and 30.

The first unit 10 and the second unit 2
0, and the third unit 30 includes VBUS boards 11 and
1, 31 include general-purpose CPU boards 13, 23, 33, I / O
O module boards 15, 25, and 35, a storage device for storing control software (control data) for controlling and calculating process data, and the like are provided. Further, data such as internal process data and control logic parameters are stored. A data change software module for changing is implemented. An MMI (man-machine interface) 50 for transmitting change data to each unit is connected to each of the I / O module boards 15, 25, and 35.

The VBUS boards 11, 21, and 31 have a function of transferring data between the units 10, 20, and 30 and exchanging synchronization signals, and exchange data with the general-purpose CPU boards 13, 23, and 33 via the VME bus. It is connected to the. Also, the VBUS boards 11, 21, 3 of the units 10, 20, 30
1 are mutually connected by V bus transmission lines 17 and 27 for data transfer and synchronization signal exchange.

I / O module boards 15, 25, 35
Is designed to input process data from the plant and output it to the general-purpose CPU boards 13, 23 and 33, and to input operation data from the general-purpose CPU boards 13, 23 and 33 and output the data to the plant. It has become.

Each of the general-purpose CPU boards 13, 23, and 33 has a CPU mounted thereon and is configured to be compatible with the VME bus. As described above, the I / O module boards 15, 25, and 35 are provided. The control signal is input through the VME bus to execute control software for controlling the entire system, and the signal is again input through the VME bus.
/ O module substrates 15, 25, and 35.

FIG. 2 shows the mechanism of this control operation.

As shown in FIG. 2, the control operation is periodically performed in the order of (1) external input processing i, (2) control operation processing c, and (3) external output processing o. The control cycle T can be created as, for example, 10 msec.MIN by a general-purpose CPU board, and the general-purpose CPU board periodically outputs a signal for resetting or presetting the start s of the control cycle T to all units. As a result, all the system units (units) can be synchronized with the start s timing of the control cycle T at the same time.

Next, a data change method according to the present invention will be described with reference to FIG.

As shown in FIG. 3, the data change method according to the present invention includes a transfer 41 of changed data, a check 42 of a hardware signal for data change synchronization, and a data change request 4.
3, data change 44, and data change end 45 are performed in this order.

The details of each process will be described together with the operation.

(1) Change data transfer 41; external MM
From I (man-machine interface), change data is transmitted to each unit in order.

(2) Data change synchronization hardware signal check 42; Each unit turns on the synchronization signal when it receives the change data. This change data is stored in a storage device provided on the CPU board of each unit.
Also, confirm that the synchronization signal is ON at the input side of each unit. Here, the input side synchronization signal is OF
If F remains, it is determined that an abnormality has occurred in the data change synchronization signal line, and an abnormality occurrence signal is transmitted to the MMI.

(3) Data change request 43; MMI is 3
When there is a reply from all the units that the data change synchronization signal lines are in a normal connection state, the data change command is transmitted to each unit again.

(4) Data change 44: When each unit receives the data change command, it turns on the synchronization signal at the timing of the output processing of the control cycle.

At this time, a synchronization signal from the first unit is input to the own unit, the second unit, and the third unit.

Then, at the timing when the synchronization signal ON of the first unit is output, all the units can simultaneously input the signal change, and the signal change is read from the change data stored in the storage device described above. Upon detection, the control data is changed at the beginning (input processing) of the next operation cycle.

That is, the control operation cycles of the three units are executed in synchronization with each other, the timing of turning on (outputting) the synchronization signal is the timing of the output processing of the control cycle, and the timing of inputting the synchronization signal is This is the timing of the input processing of the control cycle.

When the data change is completed, the MM
A signal is sent to inform I that data has been changed normally.

(5) End of data change 45; When all normal signals are received from the three units, the data change process is completed.

By performing the data change according to the above-described procedure, it becomes possible for the three units to simultaneously and reliably execute the data change.

As described above, according to the present invention, when control data is changed, data redundancy can be maintained, and majority processing can be performed before and after control data change, so that detection and generation of alarms are not delayed. The safety of the plant is improved and the normal operation of the plant can be maintained.

[0039]

In summary, according to the present invention, the control data of a plurality of units can be changed at the same time without losing redundancy, so that the detection and generation of alarms are not delayed, and the safety of the plant is improved. The plant can maintain normal operation.

[Brief description of the drawings]

FIG. 1 is a schematic diagram of a system unit of a triple system according to the present invention.

FIG. 2 is a diagram illustrating a control cycle of a control calculation unit included in the system unit of FIG. 1;

FIG. 3 is a flowchart of a data change method according to the present invention.

FIG. 4 is a system configuration diagram of a triple system.

FIG. 5 is a diagram showing a timing shift when data of a system unit is changed by a conventional data change method.

[Explanation of symbols]

 Reference Signs List 10 first unit 13 CPU board (control calculation section) 15 I / O module board (input / output section) 20 second unit 23 CPU board (control calculation section) 25 I / O module board (input / output section) 30 third unit 33 CPU board (control operation unit) 35 I / O module board (input / output unit) 40 Synchronous signal line for data change

Continued on the front page (72) Inventor Masaaki Tomizawa 3-1-1, Toyosu, Koto-ku, Tokyo Ishikawajima-Harima Heavy Industries Co., Ltd. Toni Technical Center (72) Inventor Sadao Degawa 3-1-1, Toyosu, Koto-ku, Tokyo No. Ishikawajima Harima Heavy Industries, Ltd. Toji Technical Center F term (reference) 5B034 AA05 CC01 DD06 5H209 AA01 BB01 CC01 DD04 GG04 SS02 SS04 SS07 TT04

Claims (1)

[Claims] The first to third units are connected in parallel,
The plant data of each system, which is periodically input from the input / output unit of each unit, is subjected to majority processing, and after being calculated by the control operation unit, the operation result of each system is subjected to majority processing and is periodically transmitted to the operation system of the plant. In the output triple fault tolerant system, the input / output units of the first to third units are connected to each other by a data change synchronizing signal line, and when each unit receives change data from an external man-machine interface, the synchronizing is performed. For diagnosis of signal lines, output synchronization signals to all units, and after all units receive the synchronization signals, output reception signals to the man-machine interface, and the man-machine interface outputs those reception signals from all units. Outputs a data change command to all units when received, and when all units receive the data change command, The control unit changes the control data by outputting the synchronization signal from the first unit to all units via the synchronization signal line in the cycle of the above, and inputting the change data at the timing when all the units receive the synchronization signal in the next cycle. A data change method for a triple fault tolerant system, comprising: