JPH03244001A - Triplex controller - Google Patents

Abstract

PURPOSE:To improve the reliability of a triplex controller against other troubles occurring thereafter by ensuring an operation as a triplex system with the normal working of three control circuits, and using two nondefective control circuits after a fixed time in order to secure a queued duplex system when one of these three control circuits has a trouble. CONSTITUTION:A majority circuit 6 is provided to select one of those outputs of three control circuits 7a - 7c via the decision by majority or the selection of the intermediate value together with a monitoring circuit 8 which monitors the working of each control circuit, and a signal selection circuit 9 which selects one of four output signals of the circuits 7a - 7c and the 6 as a control signal based on the output of the circuit 8. Then the output of the circuit 6 is selected for operation of a triplex controller when the circuits 7a - 7c have the normal working. If one of these three control circuits has a trouble, the prescribed one of outputs of other two nondefective control circuits is selected after a fixed time. Thus the operation of a queued duplex system is ensured. As a result, the working reliability is improved in a triplex system even if one of three control circuits has a trouble.

Description

DETAILED DESCRIPTION OF THE INVENTION [Object of the Invention] (Industrial Application Field) The present invention relates to a triplex control device for controlling a semiconductor power conversion device used as power plant equipment.

(Prior Art) Generally, a semiconductor power conversion device is used in an electric motor drive device, and FIG. 4 shows an example of a conventional triplex control device for controlling this semiconductor power conversion device.

In Fig. 4, 1 and 2 are converters that perform semiconductor power conversion, 3 is a DC reactor that controls the pulsating voltage between converters 1 and 2, and 4 is composed of converter 1.2 and DC reactor 3. 5 is an AC motor, 6 is a majority circuit, 7a to 7C are control circuits of the same configuration, and 8 is a common monitoring circuit.

The operation of the circuit of FIG. 4 constructed in this manner will be briefly described. First, AC power is converted into a desired DC voltage by the converter 1, smoothed by the DC reactor 3, and then converted into AC of a desired frequency by the converter 2. The output signals of the three control circuits 7a to 7c are applied to the majority circuit 6, where majority logic is applied. The signal tripled by this majority logic is used to control converters 1 and 2. At this time, the three control circuits 7a to 7c exchange signals such as control state quantities with each other, and mutually perform corrections so as not to upset the balance of the triplexing. In other words, the main circuit 4 that performs power conversion is a single system, but its control circuit is a parallel circuit consisting of three control circuits 7a to 7C with the same configuration.
It is a heavy system.

Furthermore, a common monitoring circuit 8 is provided for the three control circuits 7a to 7C, and this monitoring circuit 8 checks the balance of the triplexing and determines the presence or absence of an abnormality. When an abnormality is detected in the monitoring circuit 8, an alarm signal is output, thereby informing the maintenance supervisor of the abnormality.

Here, the majority circuit 6 will be explained in detail using FIG. 5.

In FIG. 5, signals a, b, and c are output signals of control circuits 7a to 7C, respectively. The majority circuit 6 inputs the signals a to C, and sets the output signal m to "1" when two or more of the three input signals are "1", and otherwise outputs "0".
shall be. Therefore, as shown in FIG. 5, even if the control circuit 7b fails and no signal is generated from the control circuit 7b, the output signal m resulting from the majority vote will not be generated by the control circuit 7b.
is not affected by the failure of Further, even if a failure occurs in which the output signal m of the control circuit 7b remains at "1" and does not change at time t3 in FIG. 5, the output signal m is not affected.

As described above, with the configuration shown in FIG. 4, the control circuits are tripled, and a redundant and highly reliable system can be realized.

Next, a case where two of the three control circuits 7a to 7c fail in succession due to some factor in the triplex control device will be described using FIG. 6. FIG. 6 is a continuation of FIG. 5, and shows a situation where the control circuit 7b has failed and has not been repaired even though an alarm has been output.

At this time, even though it is a triplex system, it is no longer in a redundant and highly reliable state. As shown in FIG. 6, the control circuit 7a fails after the control circuit 7b, and the signal a
If no longer occurs, the output m resulting from the majority vote will also no longer be output. This phenomenon similarly occurs when the control circuit 7C rather than the control circuit 7a fails and the control signal C is not generated.

In other words, if one of the three systems is out of order, the next time either of the remaining two breaks down, the effect will be immediately felt, and there is a problem that normal control operations will not be able to be performed.

Furthermore, if one of the two control circuits is out of order in a triplex system, if an abnormality occurs in either of the two control circuits that cannot be detected by self-diagnosis of one control circuit alone, the output signals of those two control circuits will differ. Although it is possible to detect that there is a failure, it is not possible to determine which one is at fault, so there is a problem in that it is not possible to immediately restart the operation.

(Problem to be solved by the invention) Conventionally, if one of the triplex systems is out of order, normal control operations cannot be executed no matter which of the remaining two is out of order, resulting in loss of reliability. There were some drawbacks.

The present invention has been made in view of the above points, and an object of the present invention is to provide a triplex control device that can realize highly reliable control operations even when one of the triplex systems is out of order. With the goal.

[Structure of the Invention] (Means for Solving the Problems) In order to achieve the above object, the present invention provides a triplex control device that controls the operation of a controlled device using three control circuits. Triple output means for selectively outputting one output from the outputs of the control circuit by majority vote or intermediate value selection;
monitoring means for monitoring the operation of each control circuit; and based on the output of the monitoring means, one of the four output signals of the outputs of the three control circuits and the output of the triplex output means is output as a control signal. 3. Signal selection means for selecting as
When one control circuit is normal, the output of the triplex output means is selected to operate as a triplex system, and when an abnormality in one control circuit is detected, the remaining two output means are activated after a certain period of time has passed. 3, characterized in that a predetermined control circuit output from the control circuit is selected to operate as a standby dual system.
The present invention provides a weight control device.

(Function) In the triplex control device configured as described above, three
After one of the dual control circuits fails, the system switches to the standby dual system, so even if one of the remaining two control circuits subsequently fails, if the failure occurred on the standby side, It does not affect the entire system. On the other hand, when the operating side of the standby dual system fails, it affects the whole system, but it can be assumed by the monitoring means that it is a failure on the operating side, and the two control circuits can be switched and restarted using the control circuit on the standby side. system recovery can be achieved.

(Example) Hereinafter, the present invention will be described in detail with reference to the drawings.

FIG. 1 shows a triplex control device according to a first embodiment of the present invention. This triplex control device controls, for example, a semiconductor power conversion device provided in a motor drive device, and includes a signal selection circuit 9 in addition to the conventional configuration shown in FIG. This signal selection circuit 9 controls the main circuit 4 with the redundant output y, and receives the majority result output m from the majority decision circuit 6 as well as output signals a to c from the control circuits 7a to 7c. Further, this signal selection circuit 9 is supplied with a selection signal sel from the monitoring circuit 8, and the selection operation of the signal selection circuit 9 is performed using the selection signal sel.
controlled by

Next, with reference to FIG. 2, the operation of the triplex control device shown in FIG. 1 will be explained.

The timing chart in FIG. 2 corresponds to the case where the control circuit 7a fails while the control circuit 7b fails. In order to prevent a one-time failure or malfunction from being detected as a failure, the monitoring circuit 8 waits for a certain period of time and switches the selection signal sel from the majority mode to the selection A mode at time t1. In this selection A mode, the signal selection circuit 9 selects the output signal a from the control circuit 7a and outputs it as the redundant output y. In the example shown in FIG. 2, the control circuit 7a is out of order following the control circuit 7b, and the output signal a is not generated. Therefore, redundant output y is also not generated. Therefore, the system cannot function, and the system is temporarily stopped. However, since the system was stopped in selection A mode,
It can be presumed that the control circuit 7a has failed.

Next, at time t2, the monitoring circuit 8 changes the selection signal sel from the selection A mode to the selection C mode due to the activation of the protection or the self-diagnosis signal from the control 7a. For this reason,
After time t2, the output signal C of the control circuit 7c is directly supplied to the main circuit 4 as the redundant output y, and the operation of the system is restarted. In this way, system recovery is accomplished quickly and automatically.

Furthermore, if the control circuit 7c instead of the control circuit 7a fails after time t1, the selection signal sel is in the selection A mode, so the output signal a is output as is as the redundant output y. Therefore, the system continues to operate without stopping.

Next, a second embodiment of the present invention will be described using FIG. In addition to the configuration shown in FIG. 1, the circuit shown in FIG. 3 has an abnormality detection function in a triplex configuration in which the abnormality detection function is placed in each of the three control systems.

That is, the second embodiment differs from the first embodiment in the following points. The control circuits 7a to 7c of the second embodiment are provided with a mutual monitoring function, and furthermore, the abnormality detection circuit 10a
-10c are provided in association with each control circuit 7a-7c. As a result, each control system 11a to llc is configured including a control circuit and an abnormality detection circuit. Also, the second
The monitoring circuit 12 of the embodiment does not include an abnormality detection function.

In this embodiment, by including mutual monitoring between each control circuit and an abnormality detection circuit in each control system, the fault detection function is also triplexed. Reliability when switching to a system can be significantly improved.

In this embodiment as well, it is clear that when one control system fails, the triplex system is switched to the standby dual system after a certain period of time, which is the gist of the present invention.

In the first and second embodiments, one output is selected from the outputs of the three control circuits by the majority logic of the majority circuit 6, but depending on the form of the output signal of the control circuit, the intermediate value may be selected instead of the majority circuit 6. A triplex system can be similarly constructed by providing a selection circuit and selecting and outputting an intermediate value of the outputs of the three control circuits.

[Effects of the Invention] As explained above, according to the present invention, in a triplex control device for a motor drive device using a semiconductor power conversion device, when three control circuits are normal, the triplex system is operated. When one control circuit 1 fails, wait for a certain period of time to prevent one-time failures or malfunctions, and then use the remaining two healthy control circuits to form a standby redundant system. Therefore, it is possible to improve reliability against other failures that occur after that, and to automatically restore operation in a shorter time.

[Brief explanation of drawings]

FIG. 1 is a configuration diagram showing a first embodiment of the present invention, FIG. 2 is a timing chart showing the operation of the first embodiment shown in FIG. 1, and FIG. 3 is a diagram showing a second embodiment of the present invention. The configuration diagram, FIG. 4 is a configuration diagram showing a conventional triplex control device, and FIGS. 5 and 6
This figure is a timing chart showing the operation of the conventional device shown in FIG. 4. 1.2...Converter, 3...DC reactor, 4...
・Main circuit, 5... AC motor, 6... Majority circuit,
7a to 7C...control circuit, 8, 12...common monitoring circuit, 9...signal selection circuit, 10a to 10c...abnormality detection circuit, 11a, llc...control system.

Claims (1)

[Claims] In a triplex control device that controls the operation of a controlled device using three control circuits, triplex output means selects and outputs one output from the outputs of the three control circuits by majority vote or intermediate value selection; a monitoring means for monitoring the operation of the control circuit; and based on the output of the monitoring means, one of the four output signals of the outputs of the three control circuits and the output of the triplex output means is used as a control signal. When the three control circuits are normal, the signal selection means for selecting the three control circuits is provided.
When the output of the duplication output means is selected to operate as a triplex system, and an abnormality in one control circuit is detected, the output of a predetermined control circuit of the remaining two control circuits is changed after a certain period of time has elapsed. A triplex control device characterized by selectively operating as a standby dual system.