JP2009217650A - Duplication control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a duplication control system can improve the reliability of a protection function because an output of a protection signal is made effective in a standby system mode. <P>SOLUTION: In duplicated systems 1 and 2 of a control system and a standby system which are respectively provided with control logics 3 and 6 for creating control signals 9 and 12 for controlling a control target from an input signal, protection logics 5 and 8 for generating protection signals 11 and 14 for protecting the control target from the input signal, the system 1 of the control system does not output the protection signal, but the system 2 of the standby system outputs the protection signal by making the protection logic operate. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a duplex control system having a control function and a protection function, and in particular, improves the reliability of the protection function.

  In the conventional digital excitation control system, a protection function may be required as a backup of the control function. In the conventional analog AVR system, the control function and the protection function are realized by providing two separate devices (hardware) and duplicating them. In the dual digital excitation control system, since the control function is configured by software, it is not necessary to provide a separate device. However, when providing a protection function, in the conventional dual digital system, the control function is duplicated and the protection function is realized by using a device (hardware) different from the control function, or The same control function and the same hardware must be implemented by software. Further, the dual control function employs a mutual hot standby system in which one is a control system and the other is a standby system (see, for example, Patent Document 1).

Japanese Patent Laid-Open No. 03-278238

  In the conventional dual control system, from the viewpoint of separation of control and protection, it is necessary to provide hardware for protection in addition to the hardware of the control system, thereby reducing the space factor of the control device and reducing the cost. There was a problem of being up. In addition, there is a problem that maintenance and inspection items increase due to separation of hardware.

  In addition, in the case of the conventional dual configuration of the mutual hot standby system, the standby system does not perform control / monitoring or the like, and simply stands by, and the protection function is implemented only by the control system. There was a problem that it decreased.

  The present invention has been made to solve the above-described problems, and an object thereof is to provide a duplex control system that improves the reliability of the protection function.

The present invention includes first and second systems each including control logic for generating a control signal for controlling a control target from an input signal, and protection logic for generating a protection signal for protecting the control target from the input signal. In a duplex control system having
Either the first system or the second system is a control system in which the control logic operates and outputs a control signal, and the other is a standby system that does not output the control signal,
In the control system, the protection signal is not output, and in the standby system, the protection logic operates to output the protection signal.

The duplex control system according to the present invention includes a control logic for generating a control signal for controlling a control target from an input signal, and a protection logic for generating a protection signal for protecting the control target from the input signal. In a duplex control system having a first and a second system,
Either the first system or the second system is a control system in which the control logic operates and outputs a control signal, and the other is a standby system that does not output the control signal,
In the control system, the protection signal is not output, and in the standby system, the protection logic operates and outputs the protection signal.
Since the output of the protection signal is valid during the standby system, the reliability of the protection function can be improved.

Embodiment 1 FIG.
Embodiments of the present invention will be described below. FIG. 1 is a block diagram showing the configuration of a duplex control system according to Embodiment 1 of the present invention, and FIG. 2 is a flowchart for explaining the operation of the duplex control system shown in FIG. In the figure, a dual system control system formed in a duplex system for controlling a controlled object from an input signal is composed of a control system 1 and a standby system 2 as first and second systems. ing. The control system system 1 includes a control logic 3 for generating a control signal 9 for controlling a control target by inputting an input signal from the outside, and a limit signal 10 for limiting the output or input in controlling the control target. The standby logic system 2 includes a restriction logic 4 to be created and a protection logic 5 to create a protection signal 11 to be controlled from the input signal. A limiting logic 7 for creating a signal 13 and a protection logic 8 for creating a protection signal 14 to be controlled from an input signal are provided.

  In the control system in which the first system outputs a control signal to the control target, in the standby system in which the second system does not output the control signal to the control target, and the first system sets the control signal to the control target. Since the second system is a standby system that does not output and the second system is a control system that outputs a control signal to the control target, the control system 1 and the standby system 2 are shown here for convenience. Needless to say, the standby system 2 may be used as a control system, and the same can be said in the following embodiments, and the description thereof will be omitted as appropriate.

  Next, the operation of the duplex control system of the first embodiment configured as described above will be described with reference to FIG. First, the system is activated (step S1 in FIG. 2), and it is determined whether or not it is an instruction to operate the control system (step S2 in FIG. 2). And if it judges that it is a control system (YES), the control system 1 will operate | move. Then, the control logic 3 and the limiting logic 4 of the control system 1 operate, and the control signal 9 and the limiting signal 10 are generated from the input signal. Then, the control signal 9 and the limit signal 10 are output to the controlled object. Also, the protection logic 5 operates and creates the protection signal 11 from the input signal, but does not output it to the control target (step S3 in FIG. 2).

  If it is determined that it is not a control system (NO in step S2 in FIG. 2), it is determined that it is a standby system (step S4 in FIG. 2), and the standby system 2 operates. Then, the control logic 6 and the limiting logic 7 of the standby system 2 operate and create the control signal 12 and the limiting signal 13 from the input signal, but do not output them to the controlled object. Further, the protection logic 8 creates a protection signal 14 from the input signal and outputs it to the controlled object (step S5 in FIG. 2). Then, the protection logic 8 determines whether or not the input signal is outside the protection area (step S6 in FIG. 2). If it is determined that the protection area is not reached (YES), a protection signal is output to the control target (step S8 in FIG. 2). On the other hand, if it is determined that the protection area is not deviated (NO), the protection signal is not output to the control target (step S7 in FIG. 2).

  According to the first embodiment, a system in which the control and protection functions are separated can be constructed without adding a special protection device, and the reliability of the protection function can be improved.

Embodiment 2. FIG.
In the first embodiment, since the protection signal is output only from the standby system 2, when an abnormality occurs in the standby system 2, the protection signal cannot be output. Therefore, the second embodiment will explain what solves this problem. FIG. 3 is a flowchart for explaining the operation of the duplex control system according to the second embodiment of the present invention. The configuration of the duplex control system is the same as that of the first embodiment, and will be described with reference to FIG.

  Next, the operation of the duplex control system of the second embodiment configured as described above will be described with reference to FIG. First, as in the first embodiment, the system is activated (step S1 in FIG. 3), and it is determined whether or not it is an instruction to operate the control system (step S2 in FIG. 3). When it is determined that the control system is in effect (YES), it is determined whether or not the other system (standby system 2) is abnormal (step S21 in FIG. 3). If it is determined that there is no abnormality (NO), the control system 1 operates as in the first embodiment. Then, the control logic 3 and the limiting logic 4 of the control system 1 operate, and the control signal 9 and the limiting signal 10 are generated from the input signal. And it outputs to the control object of the control signal 9 and the limitation signal 10. Further, the protection logic 5 operates and creates the protection signal 11 from the input signal, but does not output it to the control target (step S3 in FIG. 3).

  In addition, if it is determined that there is an abnormality (YES), the control system 1 operates. Then, the control logic 3 and the limiting logic 4 of the control system 1 operate, and the control signal 9 and the limiting signal 10 are generated from the input signal. And it outputs to the control object of the control signal 9 and the limitation signal 10. Also, the protection logic 5 operates and creates the protection signal 11 from the input signal and outputs it to the control target (step S22 in FIG. 3). Then, the protection logic 5 determines whether or not the protection signal 11 is outside the protection area (step S6 in FIG. 3). When it is determined that the protection area is not reached (YES), a protection signal is output to the control target (step S8 in FIG. 3). If it is determined that the protection area is not deviated (NO), the protection signal is not output to the control target (step S7 in FIG. 3). Since the operation of the standby system 2 is the same as that of the first embodiment, the description thereof is omitted.

  According to the duplex control system of the second embodiment configured as described above, the standby system of the duplex system becomes abnormal as well as the same effect as the first embodiment. Even in such a case, since the protection function can be achieved by the control system, the reliability of the protection function can be improved. In the event that both systems become abnormal, it becomes impossible to control, so it goes without saying that an abnormal signal (trip signal) is output as in the conventional case.

Embodiment 3 FIG.
FIG. 4 is a block diagram showing the configuration of the duplex control system according to Embodiment 3 of the present invention, and FIG. 5 is a flowchart for explaining the operation of the duplex control system shown in FIG. In the figure, the same parts as those in the above embodiments are denoted by the same reference numerals, and description thereof is omitted. In each of the above embodiments, the output of each logic is switched depending on whether it is a control system or a standby system. However, in this third embodiment, the protection logic is a logic that is not used for control. In the description, the protection logic is not driven, and in the case of a standby system, the control logic is not driven to reduce the calculation load.

  Next, the operation of the duplex control system of the third embodiment configured as described above will be described with reference to FIG. First, as in each of the above embodiments, the system is activated (step S1 in FIG. 5), and it is determined whether or not it is an instruction to operate the control system (step S2 in FIG. 5). And if it judges that it is a control system (YES), the control system 1 will operate | move. Then, the control logic 3 and the limiting logic 4 of the control system 1 operate, and the control signal 9 and the limiting signal 10 are generated from the input signal. And it outputs to the control object of the control signal 9 and the limitation signal 10. Further, the protection logic 5 does not operate and the protection signal 11 is not created from the input signal. Therefore, it does not output to the controlled object (step S31 in FIG. 5).

  If it is determined that it is not a control system (NO in step S2 in FIG. 5), it is determined that it is a standby system (step S4 in FIG. 5), and the standby system 2 operates. Then, the control logic 6 and the limit logic 7 of the standby system 2 do not operate, and the control signal 12 and the limit signal 13 are not created from the input signal. Therefore, it is not output to the controlled object. Further, the protection logic 8 creates the protection signal 14 from the input signal and outputs it to the controlled object (step S32 in FIG. 5). Then, the protection logic 8 determines whether or not the protection signal 14 is out of the protection area (step S6 in FIG. 5). When it is determined that the protection area is not reached (YES), a protection signal is output to the control target (step S8 in FIG. 5). On the other hand, if it is determined that the protection area is not deviated (NO), the protection signal is not output to the control target (step S7 in FIG. 5).

  According to the third embodiment, the same effects as those of the respective embodiments described above are obtained. In addition, in the case of a control system, the protection logic is not driven. The operation load can be reduced by not driving the.

Embodiment 4 FIG.
FIG. 6 is a block diagram showing a configuration of a duplex control system according to Embodiment 4 of the present invention, and FIG. 7 is a flowchart for explaining the operation of the duplex control system shown in FIG. In the figure, the same parts as those in the above embodiments are denoted by the same reference numerals, and description thereof is omitted. In the third embodiment, the description has been given of reducing the operation load of the system as much as possible by assuming that each logic does not output depending on whether it is a control system or a standby system. When switching as a control system due to an abnormality, shockless switching may not be possible due to parameter differences. Therefore, in the fourth embodiment, what can perform shockless switching will be described.

  Next, the operation of the duplex control system of Embodiment 4 configured as described above will be described. First, as in the above embodiments, the system is activated (step S1 in FIG. 7), and it is determined whether or not an instruction for operation of the control system is given (step S2 in FIG. 7). And if it judges that it is a control system (YES), the control system 1 will operate | move. Then, the control logic 3 and the limiting logic 4 of the control system 1 operate, and the control signal 9 and the limiting signal 10 are generated from the input signal. And it outputs to the control object of the control signal 9 and the limitation signal 10. Further, the protection logic 5 does not operate and the protection signal 11 is not created from the input signal. Therefore, it does not output to the controlled object (step S31 in FIG. 7).

  If it is determined that it is not a control system (NO in step S2 in FIG. 7), it is determined that it is a standby system (step S4 in FIG. 7), and the standby system 2 operates. Then, the control logic 6 and the restriction logic 7 of the standby system 2 operate and create the control signal 12 and the restriction signal 13 from the input signal, but do not output them to the controlled object. Further, the protection logic 8 creates a protection signal 14 from the input signal and outputs it to the controlled object (step S5 in FIG. 7). Then, the protection logic 8 determines whether or not the protection signal 14 is out of the protection area (step S6 in FIG. 7). When it is determined that the protection area is not reached (YES), a protection signal is output to the control target (step S8 in FIG. 7). If it is determined that the protection area is not deviated (NO), the protection signal is not output to the control target (step S7 in FIG. 7).

  According to the fourth embodiment, the same effects as the above-described embodiments can be obtained, and since the protection logic of the control system is not operated, the calculation load of the system can be reduced. Because the control signal is created as operating the control logic in the protection system, when the standby system is switched to the control system, the control signal is created and can be output immediately, It is possible to perform switching without any problems.

Embodiment 5 FIG.
FIG. 8 is a block diagram showing the configuration of the duplex control system according to Embodiment 5 of the present invention, and FIG. 9 is a flowchart for explaining the operation of the duplex control system shown in FIG. In the figure, the same parts as those in the above embodiments are denoted by the same reference numerals, and description thereof is omitted. In each of the above embodiments, an example in which the output of the protection signal is operated only in the standby system has been described. However, in the fifth embodiment, both the control system and the standby system operate to output the protection signal. What duplicates the function will be described. In the figure, the same parts as those in the above embodiments are denoted by the same reference numerals, and description thereof is omitted. A protection unit 15 that receives the protection signals 11 and 14 output from the control system 1 and the standby system 2 and outputs a protection signal to a control target is provided. The protection unit 15 includes the control system 1 and the standby system 2. When the protection signals 11 and 14 different from both are input, the protection signal is not output, and when not, the input protection signal is output.

  Next, the operation of the duplex control system of the fifth embodiment configured as described above will be described with reference to FIG. First, the system is activated (step S1 in FIG. 9), and it is determined whether or not it is an instruction to operate the control system (step S2 in FIG. 9). And if it judges that it is a control system (YES), the control system 1 will operate | move. Then, the control logic 3 and the limiting logic 4 of the control system 1 operate, and the control signal 9 and the limiting signal 10 are generated from the input signal. And it outputs to the control object of the control signal 9 and the limitation signal 10. Also, the protection logic 5 operates and creates the protection signal 11 from the input signal and outputs it to the control target (step S51 in FIG. 9).

  If it is determined that it is not a control system (NO in step S2 in FIG. 9), it is determined that it is a standby system (step S4 in FIG. 9), and the standby system 2 operates. Then, the control logic 6 and the restriction logic 7 of the standby system 2 operate and create the control signal 12 and the restriction signal 13 from the input signal, but do not output them to the controlled object. Further, the protection logic 8 creates a protection signal 14 from the input signal and outputs it to the controlled object (step S5 in FIG. 9). Then, the protection logic 5 of the control system 1 determines whether or not the protection signal 11 is outside the control system protection area (step S52 in FIG. 9). When it is determined that the control system protection area is not reached (YES), a protection signal for the control system system 1 is output (step S54 in FIG. 9). If it is determined that the control system protection area has not been exceeded (NO), the protection signal of the control system system 1 is not output (step S53 in FIG. 9).

  Next, when the protection signal of the control system 1 is output, it is determined whether or not the standby system 2 is normal (step S55 in FIG. 9). If it is determined to be normal (YES), the protection logic 8 of the standby system 2 determines whether or not the protection signal 14 is outside the standby protection area (step S58 in FIG. 9). If it is determined that the control system protection area is not reached (YES), the protection signal of the standby system 2 is output, and further, the protection signal of the control system system 1 is output. A protection signal is output to (step S61 in FIG. 9). Further, if it is determined that the standby system protection area is not deviated (NO), the protection signal is not output to the control target (step S59 in FIG. 9). Next, since it is determined that the protection signal is output on the control system system 1 side, it is determined that the protection signal is not output on the standby system system 2 side, and the determinations of the two systems do not match. A signal (ALARM) is transmitted assuming that the protection function of the system is abnormal (step S60 in FIG. 9).

  If it is determined that standby system 2 is not normal (NO in step S55 of FIG. 9), the protection signal of standby system 2 is not output (step S56 of FIG. 9). Then, a signal (ALARM) is transmitted assuming that the standby system 2 is abnormal (step S60 in FIG. 9). Further, if it is determined that standby system 2 is not normal (NO in step S55 in FIG. 9), the protection signal that is operated in control system 1 even if the protection signal of standby system 2 is not output. Is output as a protection signal to the controlled object (step S61 in FIG. 9).

  According to the fifth embodiment, since the protection function is performed in a duplicated manner without adding a special protection device, the reliability can be further improved.

Embodiment 6 FIG.
FIG. 10 is a block diagram showing the configuration of the duplex control system according to Embodiment 6 of the present invention, and FIG. 11 is a flowchart for explaining the operation of the duplex control system shown in FIG. In the figure, the same parts as those in the above embodiments are denoted by the same reference numerals, and description thereof is omitted. In order to protect the control target from the input signal, a protection means 16 is provided that creates a protection signal 17 and outputs it to the control target.

  Next, the operation of the duplex control system of the sixth embodiment configured as described above will be described with reference to FIG. First, as in each of the above embodiments, the system is activated (step S1 in FIG. 11), and it is determined whether or not it is an instruction to operate the control system (step S2 in FIG. 11). And if it judges that it is a control system (YES), the control system 1 will operate | move. Then, the control logic 3 and the limiting logic 4 of the control system 1 operate, and the control signal 9 and the limiting signal 10 are generated from the input signal. And it outputs to the control object of the control signal 9 and the limitation signal 10. Further, the protection logic 5 operates and creates the protection signal 11 from the input signal, but does not output it to the control target (step S3 in FIG. 11).

  If it is determined that it is not a control system (NO in step S2 in FIG. 11), it is determined that it is a standby system (step S4 in FIG. 11), and the standby system 2 operates. Then, the control logic 6 and the restriction logic 7 of the standby system 2 operate and create the control signal 12 and the restriction signal 13 from the input signal, but do not output them to the controlled object. Further, the protection logic 8 creates a protection signal 14 from the input signal and outputs it to the controlled object (step S5 in FIG. 11). Then, the protection logic 8 determines whether or not the protection signal 14 is out of the protection area (step S6 in FIG. 11). If it is determined that the protection area is not reached (YES), a protection signal is output (step S70 in FIG. 11). If it is determined that the protection area is not deviated (NO), the protection signal is not output to the controlled object (step S71 in FIG. 11).

  When the system is activated (step S1 in FIG. 11), it is determined whether or not the protection means 16 is normal (step S72 in FIG. 11). If it is determined that it is not normal (NO), a signal (ALARM) is transmitted because the protection means 16 is abnormal (step S73 in FIG. 11). When it is determined that the protection means 16 is normal (YES), the protection means 16 determines whether or not the protection signal 17 is outside the protection area of the protection means 16 (step S74 in FIG. 11). If it is determined that the protection area of the protection means 16 has not been removed (NO), a protection signal is not output to the control target (step S76 in FIG. 11). Further, if it is determined that the protection area of the protection means 16 is outside (YES), the protection means is output to the control target (step S75 in FIG. 11). Then, since the protection signal of the standby system 2 is output, and further, the protection signal of the protection unit 15 is output, the protection signal is output to the control target (step S77 in FIG. 11).

  According to the sixth embodiment, it is possible to double the protection function between the protection means and the standby system, as well as to achieve the same effect as each of the above-described embodiments, thereby further improving the reliability. Can be improved.

It is a block diagram which shows the structure of the duplication control system of Embodiment 1 of this invention. It is a flowchart for demonstrating operation | movement of the duplex control system shown in FIG. It is a flowchart for demonstrating operation | movement of the duplication control system of Embodiment 2 of this invention. It is a block diagram which shows the structure of the duplication control system of Embodiment 3 of this invention. It is a flowchart for demonstrating operation | movement of the duplex control system shown in FIG. It is a block diagram which shows the structure of the duplication control system of Embodiment 4 of this invention. It is a flowchart for demonstrating operation | movement of the duplex control system shown in FIG. It is a block diagram which shows the structure of the duplex control system of Embodiment 5 of this invention. It is a flowchart for demonstrating operation | movement of the duplex control system shown in FIG. It is a block diagram which shows the structure of the duplex control system of Embodiment 6 of this invention. It is a flowchart for demonstrating operation | movement of the duplex control system shown in FIG.

Explanation of symbols

1 control system system, 2 standby system, 3, 4, 5, 6, 7 control logic,
5, 8 Protection logic, 9, 10, 12, 13 Control signal,
11, 14, 17 Protection signal, 15 protection section, 16 protection means.

Claims (6)

2 having first and second systems each having a control logic for generating a control signal for controlling a control target from an input signal and a protection logic for generating a protection signal for protecting the control target from the input signal In the redundant control system,
Either the first system or the second system is a control system in which the control logic operates and outputs the control signal, and the other is a standby system that does not output the control signal,
In the control system, the protection signal is not output, and in the standby system, the protection logic operates to output the protection signal.   2. The duplex control system according to claim 1, wherein the first and second systems output the protection signal when it is detected that the other is abnormal when the control system is the control system. 3.   The first and second systems do not operate the protection logic when the control system is the control system, and do not operate the control logic when the system is the standby system. Dual control system.   The first and second systems do not operate the protection logic when the control system is the control system, operate the control logic when the control system is the standby system, but do not output the control signal, and the standby system is The duplex control system according to claim 1 or 2, wherein the control signal is output when the control system is switched. A protection unit that receives the protection signal output from the first and second systems and outputs the protection signal to a control target;
When the first and second systems are the control system, the protection logic operates to output the protection signal,
The protection unit does not output the protection signal when the protection signal different from both the first and second systems is input, and otherwise outputs the input protection signal. The duplex control system according to claim 1 or 2.   6. The duplex control according to claim 1, further comprising a protection unit that generates the protection signal for protecting the control target from the input signal and outputs the protection signal to the control target. system.

Images