JPH0328901A - Process controller - Google Patents

Abstract

PURPOSE:To attain a normal and continuous operation of a process by using the diagnostic circuits to detect the abnormality of plural controllers and current amplifiers and separating the output of the current amplifier connected to an abnormal controller. CONSTITUTION:The diagnostic circuits 7A - 7C are prepared to detect the abnormality of the multiplexed controllers 1A - 1C and current amplifiers 1A - 2C respectively. If the controller 1B has a trouble, this abnormality is detected by the diagnostic circuit 7B. Then a contact 8B is opened by an output S7B and the current output S2B of the B series is set at zero, which is equivalent to a case where the output s1B of the controller 1B and the gain KB of the amplifier 2B are set at zero. Therefore a load current S2 is kept at a normal level when the gains of amplifiers 2A - 2C are more increased at coincidence secured between both outputs S1A and S1C of controllers. Thus it is known that both amplifiers 2A and 2C are normally working in a linear area. As a result, the normal controllers function to keep the normal current S2 and to continue a normal plant operation even if one of those controllers has a trouble.

Description

DETAILED DESCRIPTION OF THE INVENTION [Object of the Invention] (Field of Industrial Application) The present invention relates to a multiplexed process control device for controlling processes.

(Prior art) In recent years, process control equipment used in plants that require high reliability, such as nuclear power plants, has been constructed in a triplex configuration, especially in the parts that require high reliability. Common. This is because, in the case of triplexing, the most probable signal can be selected easily and reliably using a method based on majority voting theory, and it is possible to completely prevent the plant from being affected by a failure in one series.

As a conventional device of this type, there is, for example, a triple selection device using current addition shown in FIG. In the figure, outputs SIA, SIB, SIC of control devices IA, IB, IC are current outputs S2A, S2 by current amplifiers 2A, 211.2C.
[3, converted to S2C and added to become load current S2, which is supplied to one end of load 3. The other end of the load 3 is connected to a feedback resistor 4, and the terminal voltage S4 of the feedback resistor 4 is fed back to the current amplifiers 2A, 2B, and 2C. The operation of current amplifiers 2A, 2B, and 2C in the above device is as follows (1
) is shown by the formula. Here, KA, KB, and Kc in the above equation (1) represent the gains of the current amplifiers 2A, 2B, and 2C. Further, the current S2 supplied to the load 3 is expressed by the following equation (2). S2=S2A+S2B+S2G
(2) Furthermore, the terminal voltage S4 of the feedback resistor 4 is expressed by the following equation (3), where the resistance value of the feedback resistor 4 is Rf. S4=Rf-S2
(3) From the above equations (1) to (3), the relationship between the control device outputs SIA, SIR, and SIC and the load current S2 is as shown in equation (4) below. Here, if the gain of the current amplifier is selected as shown in equation (5) below, RfKA, RfKn, RfKc>>1 - (5)
When the control device outputs SIA, SIB, and SIC match, the load current S2 becomes as shown in equation (6) below. S22 SIA/Rf... (6) However, the characteristics of a current amplifier generally have saturation characteristics as shown in Figure 3, and when the linear region of the current amplifier output is set from 10 to C, the above ( 1) In order for the formula to hold, IsI-S4 1 <C/K (%) (C=constant)...
It is necessary that (7) holds true. Here S1 is SI
A, SIB, SIC, and K represent KA, KB, and Kc. Therefore, if IsI-541 deviates from the range of equation (7) above, K becomes extremely small as shown in FIG. 3, and S2A, S2B, and S2C fall within a certain range. For example, if the control device IC fails, the control device output SIC
Therefore, if lSIC-S41 deviates from the above range, the current amplifier output S
2C is a value in the range of Ic-C'l. Therefore, the above (
In equation 1), assuming that the current amplifier output 32G changes to the maximum value on the positive side, set szc = c' and calculate the load current S2'. If the current amplifier output S2C changes to the maximum value on the negative side, then The same is true. On the other hand, control devices IB and 1C fail and 52B=52C=
When the load current S2' is calculated as C', the variation of S2' with respect to the load current S2 is as follows. R
If fKA is chosen to be large enough, S2' becomes approximately equal to S2, and the load current can be maintained normally. Here, the feedback voltage S4' is obtained from equations (3) and (8). At this time, the fluctuation of S2' with respect to the load current S2 is as shown in equation (l3) below. At this time, if RfK^ is chosen large enough, S2' becomes S2
is almost equal to , and the load current is maintained normally.

Here, the feedback voltage is found as follows. This results in . As a result, if only one series fails, the condition of equation (7) is satisfied, and the fluctuation in load current due to one series failure can be compensated for by the other two series. This results in the above (
7) Does not satisfy Eq. Therefore, if two series fail at the same time, the remaining l series will no longer be able to compensate for the fluctuations.

As mentioned above, Fig. 4 is a block diagram of the entire apparatus shown in Fig. 2 in one system when all the triple systems in Fig. 2 are normal, when the 1 system is faulty, and when the 2 system is faulty. It is expressed.

Under normal conditions, this device has an amplifier 5A with an amplification factor of 3K, which is three times that of the individual current amplifiers, and a limit value of ±30 times the linear region of each current amplifier, as shown in Figure (a). It has a limiter 6A having a. It is represented as a block diagram in which a disturbance is added to a closed loop. Assume here that one of the triple systems fails and the output of the current amplifier of the failed system saturates to the positive side and becomes C'. The amplification factor of the current amplifier in the failed system saturates and becomes zero, and the output is fixed at C'. Therefore, as shown in the figure (b), the overall system consists of an amplifier 5B with an amplification factor of 2K and a limit value of 2C. becomes the limiter 6B. At this time, C' is newly added as a disturbance, but the third
As can be seen from the figure, the saturation value ±C' of the current amplifier and the linear region ±C are almost equal, so 2C>C'...(16
), and the effects of disturbances are completely compensated for by the feedback circuit. Next, assume that two of the triple systems fail and the outputs of the current amplifiers in the failed systems both saturate to the positive side and become C'. As in the case of system 1 failure, the entire system consists of an increaser 5C for the amplification factor and a limiter 6C for the limit value C. At this time, 2C' is newly added as a disturbance, and C<2C'...(1
7), and the disturbance exceeds the range of the limiter, so
Normal compensation is no longer possible.

Figure 5 shows the changes in the signals of each part at this time. Control device IA, IB, IC output SIA, SIB,
When S1C matches, each current amplifier 2A, 2B
, 2C, respectively equal current values S2A. S2B,
The added current S2 flows to the load 3. Due to a failure of the control device IC, for example, the control device output SI
When C decreases, the current amplifier 2C saturates in the negative direction, and as soon as its output 52C decreases, the current amplifier 2A,
The outputs S2A and 52B of 2B change in the positive direction to compensate for the decrease in 52C. As a result, the load current S2 does not change and is held at the value immediately before the mismatch.Next. Control device output SIB, S due to failure of control device IB, IC.
When IC and SIC decrease, current amplifiers 2B and 2C become saturated in the negative direction, and their outputs 32B and 52C decrease. At this time, the output S2A of the current amplifier 2A is S2B, 52
In an attempt to compensate for the decrease in C, it changes to the positive side, but it becomes saturated, and the decrease in 52B and 52C cannot be completely compensated for. As a result. When the mismatch occurs, the load current S2 deviates from the normal value in the negative direction.

(Problem to be Solved by the Invention) As mentioned above, in the multiplex selection device based on the majority theory, it is possible to maintain normal output if the failure of the control device is a failure in a minority sequence, but it is possible to maintain a normal output if the failure in the control device is in a minority sequence. If the control device fails, it will be difficult to maintain normal output except in special cases.

An object of the present invention is to provide a process control device that can continue the operation of a plant using the remaining normal control devices even if many of the multiplexed control devices fail. [Structure] (Means for Solving the Problems) The present invention provides a diagnostic circuit that detects an abnormality in each multiplexed control device and each current amplifier, and detects the corresponding abnormality when the diagnostic circuit detects the abnormality. The output of the abnormal system is separated from the current addition so that it becomes zero. (Function) Even if a multiplexed control device fails, if one system is normal, the failed control device will detect its own abnormality and reduce its output to zero, so the remaining one system control device will respond to the load. The flowing current is maintained normally and the plant continues to operate.

(Embodiment) FIG. 1 shows a configuration diagram of a process control device according to an embodiment of the present invention, and the difference between the outputs SIA, SIB, SIC of the control devices IA, IB, IC and the feedback voltage S4 is The current amplifiers 2A, 2B, and 2C convert and amplify the current to current outputs S2A', 52B', and 32C'. This current output S2A', 52B', 52C'
are diagnostic circuits 7A, 78. 7C output signal S7A
, S7B, 57C contacts 8A, 8B
, 8G, and the signals S2A and S2 at the other end of the contact
B and S2C are combined to form a load current S2, which is supplied to one end of the load 3. The other end of the load 3 is connected to a feedback resistor 4, and the terminal voltage S4 of the feedback voltage 4 is connected to the current amplifiers 2A and 2B.
, returned to 2C. Diagnostic circuits 7A, 78.7C are control devices IA, IB, IC
and information S9 representing the status of the current amplifiers 2A, 2B, and 2C.
A, S9B, S9C are input, and the control device IA, 1B,
It is designed to diagnose the IC and current amplifiers 2A, 2B, and 2C. With the above configuration, contact 8A,
When 8B and 8G are closed, the above (1) to (3)
The equation holds, and the relationship between the control device outputs SIA, SIB, and SIC and the load current S2 is as shown in equation (l8) below. Here, if the gain of the current amplifier is selected as shown in equation (19) below, RfKA, RfKs, RfKc >>1' ”
{19) When the control device outputs SIA, SIB, and SIC match, the load current S2 becomes as shown in equation (20) below. S2 ma SIA/Rf...
(20) If the control device IB breaks down,
The diagnostic circuit 78 detects an abnormality in the control device IB, and its output 57B opens the contact 8B, making the B series current output 32B zero. This is effectively the output SI of the control device.
Since it is equivalent to setting the gain Ka of the current amplifier 2B to zero, from the above equation (l8), we have the following equation.

Therefore, when the control device outputs SIA and SIC match, the gains of the current amplifiers 2A, 2B, and 2C are set according to the above (19).
If the equation is selected as shown in the equation, the load current S2 is kept the same as in the normal state as shown in equation (23) below.

S2' left SIA/Rf...
・(22) Here, when finding the feedback voltage S4, S4 云SIA ...(
23), and as a result, l SIA-S4 1″:O...
- (24), which satisfies the above overall equation (7) in which the current amplifier operates in the linear region. Next, when the control device 1tlB and IC fail, the diagnostic circuits 7B and 7C detect an abnormality in the control device 1i1B and IC, and the output signals 57B and 57C open the contacts 8B and 8.
Open C and set the outputs 52B and S2C of the current amplifier to zero. This is equivalent to setting both the output SIB, 51C of the control device and the gains KB, KC of the current amplifiers 2B, 2C to zero, so from equation (l8) above, the load current is as follows:
25). 1+Rf Therefore, if the gain of the current amplifier is selected as shown in equation (19) above, the load current will be kept the same as in normal conditions as shown in equation (26) below. S2' left SIA/Rf...(
26) Here, find the feedback voltage S4: 84″:SIA...
(27), so that l SIA-S4 lma0...
(28), which means that the current amplifier 2A is operating normally in the linear region. To explain this using Fig. 4, under normal conditions, the figure (
As shown in a), the entire process control device consists of an amplifier 5A with an amplification factor of 3K, a limiter 6A with a limit value of 3C, a load 3, and a feedback path in which a disturbance is applied. It can be expressed as a block diagram.

Here, if one of the triplex systems fails and the current amplifier of the failed system saturates to the positive side, the amplification factor of the entire device is 2K and the limit value is 2C, as shown in Figure (b). However,
Since the faulty system is isolated, there is no change in disturbance and normal control continues. Next, if two of the triple systems fail and the current amplifiers of the failed system both saturate to the positive side, the amplification factor of the entire device is K, which is limited as shown in Figure (c). The value becomes C, but since the faulty system is disconnected, there is no change in the disturbance, and normal control continues.

By the way, the diagnostic circuit, which is one of the components of the process control device according to the present invention, can be realized, for example, by the following method. First, diagnosis of a control device is performed by detecting that the output of the control device deviates from a certain conceivable range.
Diagnose as abnormal. In addition, in the case of a digital control device, it will also detect CPU abnormalities such as program processing congestion control abnormalities, memory parity checks, clock stops, calculation checks, data transmission abnormalities, power supply abnormalities, etc. that are commonly performed in digital control devices. This can be done by using On the other hand, current amplifier diagnosis can be performed by detecting that the relationship between input and output given by the amplification factor is impaired. In this case, it goes without saying that the diagnostic circuit may be installed separately. Note that in the above embodiment, the processing after failure detection was carried out by providing an output disconnection means such as a contact that disconnects the output of the failed system and makes it zero, but a circuit with saturation characteristics for the output of the failed system was A similar effect can be obtained by connecting to limit the output to a value smaller than the saturation value of the current amplifier, or by switching the output of the faulty system to a constant value depending on the polarity of the input signal. Furthermore, although the above embodiment has been explained using a triplexed process control apparatus as an example, the present invention is of course not limited to this and can be applied to all multiplexed process control apparatuses.

[Effects of the Invention] As explained above, according to the present invention, even if many systems out of multiplexed control devices fail, if there is only one system that is normal, that one system can restore the normal process. It becomes possible to continue operation, and a process control device with a high operating rate can be obtained.

[Brief explanation of drawings]

FIG. 1 is a configuration diagram of a process control device according to an embodiment of the present invention, FIG. 2 is a configuration diagram of a conventional process control device, and FIG. 3 is a configuration diagram of a conventional process control device.
The figure is an input/output characteristic diagram of a current amplifier, Figures 4 (a) to (C)
is a block diagram for explaining a failure state of the process control device, and FIG. 5 is a time chart for explaining the operation of FIG. 2. IA, IB, IC...control device, 2A, 2B,
2C...Current amplifier, 3...Load, 4...Voltage feedback device, 5^, 58. 5C...Contact, 6A. 6
B, 6C...Diagnostic circuit, 7...Proportional increase #4 device, 8.
...Restrictions Figure 2 Figure 1 d) Electric washing Figure 3 Figure 4

Claims (2)

[Claims] (1) A multiplexed control device and a plurality of current amplifiers each receiving an output signal from each of these control devices;
A circuit that combines the output currents from these multiple current amplifiers and flows them to a load, and a feedback resistor connected in series to the load.
A process control device having a feedback path that feeds back a signal corresponding to a load current to each of the plurality of current amplifiers via the feedback resistor, a diagnostic circuit for detecting an abnormality in the plurality of control devices and the plurality of current amplifiers; A process control device comprising: an output disconnection means for disconnecting the output of a current amplifier connected to a control device diagnosed as abnormal by the diagnostic circuit or the output of the current amplifier itself diagnosed as abnormal. (2) The process control device according to claim 1, further comprising a current limiting circuit as the output disconnecting means.