JP6273102B2 - Redundant supervisory control system remote I / O unit and maintenance method thereof - Google Patents

Description

  Embodiments described herein relate generally to a remote I / O unit of a redundant monitoring control system and a maintenance method thereof.

  In recent years, triggered by a major accident in a plant, functional safety standard IEC61508 was established as an international standard, and IEC61511 was issued as a plant application standard. In addition, the safety level of the system is determined, and certification by a safety certification body is performed.

  For this reason, as a means to increase the reliability of plant monitoring and control systems, a method has been adopted in which the functional modules of the monitoring and control system are made redundantly and tripled to reduce the incidence of system down due to a single failure of each module. ing.

  For example, as shown in FIG. 7, there is a duplex monitoring control system configured with a duplex network including a controller serving as two master stations and remote I / O units that are distributed and provided in remote locations serving as slave stations. is there.

  In this supervisory control system, the controller 10 and the controller 20 that are master stations and the remote I / O units 30 to 50 are connected by a transmission cable.

  The remote I / O network 100 is connected by communication cables C11, C12, C13, and C14, and the remote I / O network 200 is connected by communication cables C21, C22, C23, and C24.

  Further, the controller 10 and the controller 20 are connected by a cable C1 for monitoring the operation state of each other, synchronizing data, and equalizing data.

  The controller 10 includes a CPU 11, a transmission module 12 connected to the remote I / O unit 30, an Ethernet (registered trademark) module 13 connected to a higher-level control LAN 300, and a power supply module 14 that generates supply power for these modules. And comprising.

  Similarly, the controller 20 includes a CPU 21, a transmission module 22 connected to the remote I / O unit 30, an Ethernet (registered trademark) module 23 connected to the host control LAN 300, and a power supply module 24 of these modules, Is provided.

  Each of the remote I / O units 30 to 50 has the same configuration. Regarding the remote I / O unit 30 which is one unit, the redundant power supply modules 31 and 32, the transmission modules 33 and 34, and the I / O units 30 and 50 are the same. An O module 35 is provided.

  Such a duplex monitoring control system is configured when a redundant redundancy type (Duplex) is configured in which one of the controller 10 or the controller 20 is operating and the other is in standby, or the other is in a hot standby state comparative redundant type (Dual). ) May be configured.

  Further, although the remote I / O unit 30 is illustrated in the case where the power supply modules 31 and 32 and the transmission modules 33 and 34 are duplexed, a configuration in which the I / O module 35 is duplexed is also possible. They are connected by a power supply bus and a control bus (not shown).

  The topology of the remote I / O network 100 and the remote I / O network 200 is generally a ring type, but may be a bus type.

  The transmission modules 33 and 34 are 2-port Ethernet (registered trademark) modules, but may be 2-port switching Ethernet (registered trademark) modules. In this case, when one transmission module of the two networks fails, it is possible to switch to the other transmission module, and the master controller 10 scans the slave station at a scan time within a predetermined control period. It becomes possible.

  Further, in FIG. 7, a doubled state is taken as an example, but it may be tripled.

  As a redundancy method for a multiplexed ring network, various redundancy methods have been disclosed (see, for example, Patent Document 1).

JP 2012-151850 A

  In a multiplexed network system such as a duplex supervisory control system as shown in FIG. 7, the transmission modules 33 and 34 of the remote I / O unit 30 serving as a slave station on the network are an I / O module 35 and a power supply module. Since the power generated by 31 and 32 is shared, the power is temporarily stopped due to a sudden single failure or power failure of the remote I / O units 33 and 34, or maintenance of the I / O module 35. The power supply of the transmission modules 33 and 34 goes down.

  In this case, the remote I / O network 100 is also disconnected. Therefore, the remote I / O units 40 and 50 that are other normally operating slave station nodes are in a single bus state, and there is a problem that the reliability of the remote I / O network is lowered, and the timing of the maintenance and inspection work. There was a constrained problem.

  The present invention has been made to solve the above-described problems, and minimizes the downtime of the remote I / O network of the redundant monitoring control system, and further improves the power supply module and I / O module of the remote I / O unit. It is an object of the present invention to provide a remote I / O unit of a redundant monitoring control system that can easily perform maintenance and inspection, and a maintenance method thereof.

In order to achieve the above object, the remote I / O unit of the redundant monitoring control system of this embodiment is a remote I / O unit of the redundant monitoring control system, and any one of the redundant monitoring control systems is a master station. And a plurality of remote I / O units that are slave stations of the controller, and the controller and the plurality of remote I / O units constitute a duplicated remote I / O network. The remote I / O unit includes a redundant power supply module that generates a power supply for each module included in the remote I / O unit, a power supply bus that connects the power supply module and the module, and 2-port Ethernet (registered trademark). Communication with other slave stations and the controller as slave stations of the network. A transmission module that performs communication, an I / O module that interfaces with an input / output device that is monitored and controlled by the controller, and an external backup power source that is used when the power supply module fails or is maintained. The transmission module is a power supply for selecting either the power supply module or the external backup power supply as a power supply for the board internal circuit section that performs communication processing of the 2-port Ethernet (registered trademark) and the board internal circuit section. A control unit, a USB connector fixed to the front panel of the transmission module, for supplying the external backup power, and a first power source for opening and closing a power output supplied from the power supply module to the board internal circuit unit . A switch and an internal circuit from the external backup power source through the USB connector. A second switch that opens and closes a power output supplied to the unit, and is fixed to the front panel of the transmission module, and opens and closes a connection between a power output end of the power module and one input end of the first switch A third switch, wherein the power control unit monitors the voltage between the output terminal of the third switch and the one input terminal of the first switch, thereby detecting the voltage from the power module. When the voltage monitoring unit that monitors the supply voltage and the voltage monitoring unit detect that the supply voltage is equal to or lower than a predetermined monitoring voltage, the first switch is opened, and the second switch is The power supply of the board internal circuit unit is switched to the external backup power supply as closed, and the supply voltage from the power supply module recovers to an operating voltage that enables the board internal circuit unit to operate. A power switching control unit that controls to close the first switch and open the second switch to return the power supply to the power supply module to the power supply module when the first switch is detected. During maintenance inspection of the transmission module, the third switch is operated to cut off the supply voltage from the power supply module to the transmission module, and the external backup power supply is connected to the transmission module via the USB connector. It is characterized by being supplied.

The connection block diagram of the power supply system at the time of the maintenance of the remote I / O unit of the redundant monitoring control system of embodiment. Connection diagram of external backup power supply and remote I / O unit. The operation | movement flowchart of the power supply switching of the transmission module at the time of a power supply module failure. The time chart of the 1st case explaining operation | movement of a transmission module. The other time chart of the 1st case explaining operation | movement of a transmission module. The time chart of the 2nd case explaining operation | movement of a transmission module. The block diagram of the conventional duplication supervisory control system.

  Embodiments of the present invention will be described below with reference to the drawings. The remote I / O unit of the redundant monitoring control system of the embodiment and the maintenance method thereof will be described with reference to FIGS.

  The redundant monitoring control system and the configuration of the module of the remote I / O unit are assigned the same numbers as those described with reference to FIG. 7, and overlapping descriptions are omitted as much as possible.

  First, the configuration of the redundant monitoring control system includes two controllers 10 and 20 that are master stations, and a plurality of remote I / O units 30 to 50 that are slave stations of these controllers 10 and 20. The two controllers 10 and 20 and the plurality of remote I / O units 30 to 50 constitute a duplexed remote I / O network 100 and remote I / O network 200.

  Next, the configuration of one remote I / O unit 30 of one remote I / O network 100 will be described with reference to FIG. 2, and the description of the other remote I / O network 200 will be omitted. .

  The remote I / O unit 30 includes redundant power supply modules 31 and 32 that generate power supply for each module included in the remote I / O unit, a power supply bus (not shown) that connects the power supply module 31 and each module, and 2-port Ethernet (registration). As a slave station of the network, a transmission module 33 that communicates with other slave stations and the controller 10, an I / O module 35 that interfaces with input / output devices monitored and controlled by the controller 10, and a power source And an external backup power source 60 that is used when the modules 31 and 32 fail or are maintained.

  Next, details of the transmission module 33 will be described with reference to FIG. The transmission module 33 is a board internal circuit unit 33b that performs 2-port Ethernet (registered trademark) communication processing, and the power supply of the board internal circuit unit 33b is either the power supply module 31, 32 or the external backup power source 60. And a power supply control unit 33a for selecting.

Further, the transmission module 33 includes a USB connector 33c provided on a front panel or the like of the transmission module 33 that is inserted into and fixed to a remote I / O unit 30 (not shown), output ends of the power supply modules 31, 32, and a board internal circuit unit 33b. Between the output terminal of the external backup power source 60 and the board internal circuit section 33b, and for opening and closing the power supplied from the power modules 31 and 32 to the board internal circuit section 33b. The switch SW2 that opens and closes the power supplied from the backup power supply 60 to the board internal circuit unit 33b and the output end of the power supply modules 31 and 32 and the switch SW1 are provided from the power supply modules 31 and 32 during maintenance. A switch SW3 for forcibly disconnecting the output.

  More specifically, the power supply control unit 33a includes a power supply monitoring unit 33a1 that monitors the output voltage Vrp output from the power supply modules 31 and 32, and the substrate when the output voltage Vrp is equal to or lower than a predetermined abnormality monitoring voltage Vsd. A power supply switching control unit 33a2 that switches the power supply of the internal circuit unit 33b to the external backup power supply 60 is provided.

  When the supply voltage from the power supply modules 31 and 32 recovers to an operating voltage Va or higher at which the operation of the substrate internal circuit unit 33b is possible, the power supply switching control unit 33a2 supplies the power supply to the substrate internal circuit unit 33b to the power supply module. Return to 31 and 32 side (connect).

  Note that the recovery monitoring voltage Vsr may be either the abnormality monitoring voltage Vrp or the operable voltage Va.

  Here, the abnormality monitoring voltage Vrp is set to a range which is not more than the upper limit value of the operable voltage Va and is not less than the lower limit value of the operable voltage Va.

  The external backup power source 60 does not operate with a commercial power source, and may be configured with a battery. In this case, it is possible to prepare for a power failure of the slave station.

  Next, the operation of switching the power supply of the transmission module 33 during the maintenance work of the remote I / O unit of the redundant monitoring control system configured as described above will be described with reference to FIGS.

  There are two cases for the power supply switching operation of the transmission module 33. The first case is a case of periodic maintenance or the like, in which the external backup power source 60 can be connected to the USB connector 33c in advance. The second case is a case where the redundant power supply modules 31 and 32 have failed for some reason in a state where the external backup power supply 60 is not connected to the USB connector 33c.

  First, the operation of the first case will be described. The external backup power source 60 is connected to the USB connector of the transmission module 33 (s1).

  Next, the output of the power supply modules 31 and 32 is disconnected by operating the switch SW3. Then, the voltage monitoring unit 33a1 notifies the power supply switching control unit 33a2 that the power supply modules 31 and 32 have been disconnected because the output from the power supply modules 31 and 32 has an abnormality monitoring voltage of Vsd or less (s2). ).

  The power supply switching control unit 33a2 switches the switch SW1 from on to off, and switches the switch SW2 from off to on (s3).

  In this case, as shown in FIG. 4, the switching time T1 from the output of the power supply modules 31 and 32 (FIG. 4B) to the output of the external backup power supply 60 (FIG. 4D) is very short. Therefore, as shown in FIG. 4E, the supply voltage Vp to the board internal circuit unit 33b does not drop below the operable voltage Va of the board internal circuit unit 33b even at the time of switching.

  That is, a power capacitor (not shown) is provided at the output end of the power supply module 31/32 and the input end of the substrate internal turning portion 33b, so that the power supply for a short time is operated by the charge charges stored in the power supply capacitor. It can be maintained at or above the possible voltage Va.

  When there is anxiety about the power supply during this switching time, as shown in FIG. 5, the power source is set so that the timing when the switch S is turned on (FIG. 5C) is the timing before the switch S1 is turned off. By adjusting the control timing of the switching control unit 33a2, it is possible to perform switching without fear that the supply voltage Vp to the substrate internal circuit unit 33b will be lower than the lower limit value of the operable voltage (Va).

  Next, when the maintenance work of the power supply modules 31, 32 or the I / O module is completed, the module is attached to the remote I / O unit 30, and the switch 3 is set to OFF (s4).

  Then, the power supply control unit 33a switches the switch SW1 from off to on and switches the switch SW2 from on to off because the monitoring voltage is equal to or higher than the preset recovery monitoring voltage Vsr (s5).

  In this case, as shown in FIGS. 4E and 5E, the supply voltage Vp to the board internal circuit unit 33b does not become lower than the operable voltage Va of the board internal circuit unit 33b.

  That is, in this maintenance, even if the power supply from the power supply modules 31 and 32 is cut off, the remote I / O network 100 can continue its function by the external backup power supply 60.

  Next, the operation of the second case will be described with reference to FIGS. The voltage monitoring unit 33a1 of the transmission module 33 detects that the output of the power supply modules 31 and 32 is equal to or lower than the abnormality monitoring voltage Vsd, and notifies the power supply switching control unit 33a2 that the power supply modules 31 and 32 are disconnected. At the same time, it is output to a monitor (not shown) (s11). However, it is necessary to provide this monitor output separately from the power supply of the power supply modules 31 and 32.

  Then, the maintenance worker who performs this maintenance work connects the external backup power source 60 to the USB connector of the transmission module 33 (s12).

  The power supply switching control unit 33a2 switches the switch SW1 from on to off, and switches the switch SW2 from off to on. In this case, as shown in FIG. 6 (e), the outputs of the power supply modules 31 and 32 (FIG. 6 (b)) decrease to become lower than the lower limit value of the operable voltage Va, and the output of the external backup power supply 60 is restored. Is cut off for a time Td until the installation of the external backup power supply 60 is completed.

  Then, the transmission module 33 starts normal operation when the supply voltage Vp to the board internal circuit unit 33b becomes equal to or higher than the operable voltage Va.

  However, since this time Td is a work time for mounting the external backup power supply 60 that can be supplied by the USB connector, it can usually be suppressed within a minute order downtime, and the capacity of the external backup power supply can be reduced. By appropriately selecting the remote I / O network, it is possible to avoid an abnormal state for a long time.

  Needless to say, in the system in which the external backup power source 60 can be always attached, the external backup power source 60 can be automatically switched at the timing as shown in FIGS.

  Therefore, according to such a configuration of the present application, the downtime of the remote I / O network of the redundant monitoring control system can be minimized, and the power supply module and the I / O module of the remote I / O unit can be easily maintained and inspected. It is possible to provide a remote I / O unit of a redundant monitoring control system that can be performed and a maintenance method thereof.

  Although the embodiments of the present invention have been described, these embodiments are presented as examples, and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

10, 20 Controller 11, 21 CPU
12, 22 Transmission module 13, 23 Ethernet module 14, 24 Power module 30, 40, 50 Remote I / O unit units 31, 41, 51 Power module 32, 42, 52 Power module 33, 43, 53 Transmission Modules 34, 44, 54 Transmission modules 35, 45, 55 I / O module 33a Power supply control unit 33a1 Power supply monitoring unit 33a2 Power supply switching control unit 33a12 Abnormal / recovery voltage detection unit 33b Board internal circuit unit 33c USB connector 60 Backup power supply

Claims (2)

A remote I / O unit of a redundant monitoring control system,
The duplex supervisory control system includes two controllers, one of which is a master station, and a plurality of remote I / O units which are slave stations of the controller, and the controller and the plurality of remote I / O units Configures a duplicated remote I / O network,
The remote I / O unit includes a redundant power supply module that generates a power supply for each module included in the remote I / O unit, a power supply bus that connects the power supply module and the module, 2-port Ethernet (registered trademark), A transmission module that communicates with other slave stations and the controller as a slave station of the network, an I / O module that interfaces with an input / output device that is monitored and controlled by the controller, and the power supply module An external backup power supply used in case of failure or maintenance;
With
The transmission module selects either the board internal circuit unit that performs communication processing of the 2-port Ethernet (registered trademark) and the power supply of the board internal circuit unit from the power supply module or the external backup power source. A power control unit;
Further, a USB connector fixed to the front panel of the transmission module, for supplying the external backup power, a first switch for opening and closing a power output supplied from the power module to the board internal circuit unit , A second switch that opens and closes a power output supplied from the external backup power source to the board internal circuit unit via the USB connector; fixed to the front panel of the transmission module; A third switch for opening and closing a connection with one input end of the first switch;
With
The power supply control unit monitors a voltage between the output terminal of the third switch and the one input terminal of the first switch, thereby monitoring a supply voltage from the power supply module; When the voltage monitoring unit detects that the supply voltage is equal to or lower than a predetermined monitoring voltage, the first switch is opened and the second switch is closed to supply power to the board internal circuit unit. Is switched to the external backup power supply, and when it is detected that the supply voltage from the power supply module has recovered to an operating voltage that enables operation of the substrate internal circuit unit, the first switch is closed, A power supply switching control unit that controls the power supply module to return the power supply to the power supply module by opening the second switch.
During maintenance inspection of the transmission module, the third switch is operated to cut off the supply voltage from the power supply module to the transmission module, and the external backup power supply is supplied to the transmission module via the USB connector. A remote I / O unit of a redundant supervisory control system, characterized in that:   The remote I / O unit of a redundant monitoring control system according to claim 1, wherein the external backup power source is a battery.

Images