JPH04237309A - Digital control system - Google Patents

Abstract

PURPOSE:To easily check the soundness of a circuit for controlling an apparatus for changing the state of a controlled system to the safe side without generating erroneous recognition and erroneous operation and to widely apply this digital control system to the controlled system. CONSTITUTION:A signal generating means 13 outputs a simulation input signal for simulating an operation request for a man-machine device 1 and the status change of the controlled system P. When a soundness check request signal is outputted from the device 1, the 1st and 2nd control means 21, 22 respectively execute the logical operation of the simulation input signal, applies respective AND condition to driving means 31, 32 for driving the apparatus 100 and applies the output signals of respective monitoring means 41, 42 for monitoring the states of the driving means 31, 32 to a soundness evaluating means 15. The means 15 compares the output signals of the means 41, 42 with the simulation input signal outputted from the means 13 to evaluate the soundness of the means 21, 22 and applies an evaluation signal to the man-machine device 1.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a digital control system that uses a microprocessor to control equipment for changing the state of a controlled system to a safe side.

0002

2. Description of the Related Art It is necessary to regularly check the soundness of the operation of control devices used in safety protection systems. A conventional method of checking the health of this type of control device will be explained using FIG. 2.

A man-machine device 1 is connected to a control device 2 . A device for detecting the state of the plant P as a controlled system is also connected to the control device 2. Therefore, the control device 2 requests the operation of the man-machine device 1 and the plant P.
Based on the status signal, the equipment 100 for changing the status of the plant P to the safe side is controlled.

Of these, the man-machine device 1 includes an operation switch section 11, a display section 12, and an interface section 14. Then, the operation switch signal S1 of the operation switch section 11 is transmitted to the control device 2 via the interface section 14.
sent to. Further, a display signal S2 that displays the status of the equipment 100 and the status of the plant P sent from the control device 2 is sent to the display unit 12 via the interface unit 14.
be taken in.

The control device 2 includes a logic device 20 and a drive circuit 30. Of these, the logic device 20 inputs the operation switch signal S1 and the state signals P1 and P2 that detect the state of the plant P, performs a logical operation, and causes the drive circuit 30 to
Activation signal S7 is applied to. Moreover, the logic device 20
Open/close signal S1 of the switch that detected the state of the device 100
0 and the status signals P1 and P2 of the plant P to the man-machine device 1.

[0006] The above-mentioned drive circuit 30 is connected in series to the actuator 101 constituting the device 100, and the operation of this drive circuit 30 causes the actuator 101 to
is excited. By excitation of this actuator 101, the plant P
is controlled on the safe side. In addition, the actuator 101
The limit switch 102 detects the state of the limit switch 102 and provides an open/close signal S10 to the logic device 20.

By the way, the logic device 20 receives an operation command from the man-machine device 1 to the equipment 100 when the status signal P1 of the plant P is in the contact ON state and the status signal P2 is in the contact OFF state. The driving means 30 is operated on the condition that the signal is output.

[0008] Health check refers to an operation to check whether the logic device 20 actually performs these operations correctly. As a specific method, for example, the path of the status signal P1 is electrically shorted (jumped) and the path of the status signal P1 is short-circuited (jumped).
2 is electrically disconnected (lifted), and the switch corresponding to the drive of the device 100 is operated using the operation switch unit 11 of the man-machine device 1 to operate the drive means 30, and the device 100 is operated. The operating state of this device 100 is detected by a limit switch 102, and its opening/closing signal S10 is sent to the man-machine device 1 through the logic device 20. At this time, the lamp on the display section 12 of the man-machine device 1 turns on/off, allowing the tester to evaluate the soundness of the logic device 20.

[0009] In such a health check for the logic device 20, the actual signal lines of the plant P are connected and disconnected, so there is a risk that the plant P will be adversely affected by erroneous operation or work. Therefore, it was necessary to clearly indicate that the device was being tested, such as by placing a prohibition tag on the operation switch.

0010

[Problem to be solved by the invention] The conventional soundness confirmation method described above involves artificially creating a simulated signal.
Mistakes such as incorrect connections and forgetting to recover were likely to occur, and since operation checks were performed manually, errors in judgment were also likely to occur. In addition, when creating a simulated signal, the work involves moving away from the current plant state, so it is necessary to prohibit the operation of operation switches and take measures to prevent the impact on other equipment, which requires a great deal of labor. It took time. Furthermore, since the process amount is changed by actually driving the equipment, it is difficult to apply it to a system where changes in the process amount have a large impact on plant operation.

[0011] This invention was made to solve the above problems, and it prevents erroneous operation and misrecognition, allows easy confirmation of soundness, and enables application to a wide range of controlled systems. The purpose is to obtain a digital control system that

0012

[Means for Solving the Problems] The present invention provides a digital control system that uses a microprocessor to control equipment for changing the state of a controlled system to a safe side.
A man-machine device that outputs an operation request signal for the device and a request signal for digital control health confirmation, inputs a health evaluation signal and displays the health check result, a signal generating means for outputting a simulated input signal simulating a state change of the control system, inputting the operation request signal and the state signal of the controlled system, and outputting a health confirmation request signal from the man-machine device; first and second control means that switch and input the simulated input signal output from the signal generation means and output drive signals for the device by respective logical operations;
and a driving means for driving the device according to the AND condition of each driving signal of the second control means, a monitoring means for monitoring the state of the driving means, and a comparison between the output signal of the monitoring means and the simulated input signal. and health evaluation means for evaluating the health of the control means and applying an evaluation signal to the man-machine device.

In this case, the presence or absence of a change in the operation request signal for the device and the status signal of the controlled system is detected, and when a status change is detected during the health check based on the simulated input signal, the health check is performed. It is advantageous to provide means for detecting a change in state to abort the operation.

[0014]

[Operation] In the present invention, the signal generation means generates a simulated input signal by simulating an operation request of the equipment and a change in the state of the controlled system, and also generates a signal obtained by monitoring the state of the equipment and a simulated input signal of the signal generation means. Since the soundness of the control means is evaluated by comparing the results with those of the control means, and the results are displayed on the man-machine device, erroneous operations and misrecognitions are eliminated, and the soundness can be easily confirmed. In addition, the first and second control means perform logical operations, and the soundness is evaluated based on the results.
Since the equipment is driven according to the logical product conditions of each output, the equipment will not actually operate during the health check unless both are consciously operated. Therefore, changes in process quantities have a large impact on plant operation. It can also be applied to systems.

[0015] Here, the presence or absence of a change in the operation request signal and the status signal of the controlled system is detected, and when a status change is detected during the health check, the health check operation is stopped. It can also respond to changes in conditions that may occur during the process.

[0016]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 is a block diagram showing the configuration of an embodiment of the present invention. In the figure, the same reference numerals as those in FIG. 2 indicate the same elements. In FIG. 1, the control device 2 includes a signal generating means 13 that generates a simulated input signal for health confirmation, a health evaluation means 15 that evaluates the health, and operation signals of the man-machine device 1 and the state of the plant. While making a logical judgment on the signal, the signal generating means 13
1-system control means that makes logical judgments on simulated input signals from and outputs actuation signals for the respective drive means, and further transfers the open/close signal S10 of the limit switch 102 that detects the state of the actuator 101 to the man-machine device 1. 21 and 2 system control means 22, and actuator 1
1 system drive means 31 and 2 are inserted in series in the power supply circuit of 01 and are driven by the actuation signal of the drive means, respectively.
System driving means 32, and system 1 monitoring means 41 and 2, each consisting of a variable resistor, for determining the operating state of these driving means.
system monitoring means 42.

Of these, the internal configurations of the 1-system control means 21 and the 2-system control means 22 are completely the same, so only the internal configuration of the 1-system control means 21 will be described in detail.

The 1-system control means 21 receives status signals P1, P2 of the plant P and operation switch signals S of the man-machine device 1.
Current input area 2 where 1 is stored at a predetermined calculation timing.
1a, and a previous input area 21b that stores the contents stored in this current input area 21a at the next calculation timing.
In addition to storing a simulated input signal of the signal generating means 13,
It also includes a simulated input area 21c used as a buffer. In addition, the operation switch section 1 of the man-machine device 1
When the health check request signal S13 is added from 1 to 1,
A simulated input area 21c is provided for storing a simulated input signal S3 outputted from the signal generating means 13.

Furthermore, it is provided with a calculation content storage area 21d in which calculation logic during normal operation is stored, and a calculation content storage area 21e in which calculation logic during soundness confirmation is stored. Then, the comparison circuit 21l compares the contents of the current input area 21a and the previous input area 21b to determine whether or not there has been a change in the input signal state. The line switching means 21S1 and 21S2 are switched from the illustrated position to the opposite position and returned to the original position when a change in state occurs.

Here, the signal line switching means 21S1 selects the current input area 21a when the signal line switching means 21S1 is not switched.
The stored contents of the simulated input area 21c are passed to the logic calculation means 21f 2 , and conversely, when the switching operation is performed, the stored contents of the simulated input area 21c 1 are passed to the logic calculation means 21f 2 . Another signal line switching means 21S2 sets the normal calculation logic of the calculation content storage area 21d to the logic calculation unit 21f when the switching operation is not performed, and on the contrary, when the switching operation is performed, the calculation content storage area 21
The arithmetic logic for checking the soundness of e is set in the logic arithmetic means 21f.

The logic operation means 21f performs a logical operation on the data in the current input area 21a or the simulated input area 21c according to the internally set operation logic, and drives the 1-system drive means 31 according to the operation result. A signal S8 is output. In addition, this logic calculation means 2
1f receives the response signal S11 of the system 1 monitoring means 41, and sends it to the health evaluation means 1 via the simulated input area 21c.
5, and a function of sending the opening/closing signal s10 of the limit switch 102 to the man-machine device 1.

Note that the logic calculation means constituting the 2-system control means 22 outputs an actuation signal S9 for driving the 2-system drive means 32 according to the logical calculation result, and receives a response signal S12 from the 2-system monitoring means 42. However, it has a function of passing the signal to the soundness evaluation means 15 via an internal simulated input area, and a function of sending the opening/closing signal S10 of the limit switch 102 to the man-machine device 1.

The operation of this embodiment configured as described above will be explained below.

First, the status signals P1, P2 of the plant P and the operation switch signal S1 of the man-machine device 1 are sequentially stored in the current input area 21a at a predetermined calculation timing, and the previous stored contents are stored in the previous input area 21b. is transferred and stored. In addition, a simulated input signal for soundness confirmation outputted from the signal generating means 13 is provided in the simulated input area 21c.
is memorized. Furthermore, normal calculation logic in the calculation content storage area 21d is set in the logic calculation means 21f. The comparison circuit 21l compares the memory contents of the current input area 21a with the memory contents of the previous input area 21b.

Here, if the health check request signal S13 is not output from the man-machine device 1, regardless of whether there is a difference between the memory contents of the current input area 21a and the previous input area 21b. That is, irrespective of the presence or absence of a state change, the comparator circuit 21l maintains the signal line switching means 21S1 and 21S2 in the state shown. Therefore, the contents stored in the current input area 21a are input to the logic calculation means 21f via the signal line switching means 21S1. The logic calculation means 21f executes logical calculations on the input according to the normal operation logic set internally in advance, and outputs the activation signal S8 when the condition for changing the state of the plant P to the safe side is established to drive the 1st system. The means 31 is turned on.

A similar operation is performed in the second system control means 22, and when a condition for changing the state of the plant P to the safe side is established, an operation signal S9 is outputted to turn on the second system drive means 32. .

If both conditions for changing the state of the plant P to the safe side are satisfied, the actuator 101 is excited and the equipment 100 changes the state of the plant P to the safe side. At this time, the limit switch 102
The opening/closing signal S10 is sent to the man-machine device 1,
The examiner turns on/off the lamp on the display section 12 to
Check the operating status of 00.

Next, when there is no difference between the memory content of the current input area 21a and the memory content of the previous input area 21b,
That is, when there is no change in state, man-machine device 1 to 1
Assume that a health check request signal S13 is sent to the system control means 21. At this time, the comparison circuit 21l switches the signal line switching means 21S1 and 21S2 to the health check side, that is, to the side opposite to the illustrated state. As a result, the soundness confirmation logic stored in the calculation content storage area 21e is set in the logic calculation means 21f, while the simulated input signal stored in the simulation input area 21c is input to the logic calculation means 21f.

Therefore, the logic calculation means 21f judges the simulated input signal using the logic for checking the soundness, and outputs the operation signal S.
8 drives the 1-system driving means 31. The 1-system monitoring means 41 monitors the contact voltage of the 1-system driving means 31, and inputs a response signal S11 to the logic calculation means 21f. The logic calculation means 21f transmits to the health evaluation means 15 via the simulated input area 21c. The soundness evaluation means 15 evaluates the soundness based on the simulated input signal S3 for soundness confirmation outputted from the signal generation means 13 and the response signal S11 sent from the logic calculation means 21f. The display section 12 of the man-machine device 1
to be displayed.

Assume that the operator outputs a health confirmation request signal from the man-machine device 1 to the second system control means 22 after the health of the first system control means 21 has been confirmed in this manner. The 2-system control means 22 operates exactly the same as the 1-system control means 21 to drive the 2-system drive means 32. The second system monitoring means 42 monitors the contact voltage of the second system driving means 32. As a result, the response signal S12 is transmitted to the soundness evaluation means 15.
sent to. The health evaluation means 15 is the signal generation means 13
The soundness is evaluated based on the simulated input signal S3 for soundness confirmation and the response signal S12 outputted from the system, and is displayed on the display unit 12 of the man-machine device 1 through a route not shown. Therefore, the soundness of the second system control means 22 is confirmed.

Note that when a safety confirmation request signal is output to either one of the first system control means 21 and the second system control means 22, the healthiness request signal is not applied to the other until the confirmation operation is completed. However, in order to ensure reliability, the operation switch section 11 may be provided with an interlock function.

Next, during the health check, when a change occurs in the status signals P1, P2 of the plant P and the operation switch signal S1 of the man-machine device 1, that is, when the stored contents of the current input area 21a and the previous input area When a difference occurs between the stored contents of 21b and 21b, the comparator circuit 21l returns the signal line switching means 21S1 and 21S2 to the illustrated state. As a result, the stored contents of the input area 21a are inputted to the logic calculation means 21f via the signal line switching means 21S1. Logic calculation means 21
The logic for checking the soundness of the content storage area 21d is set in f. As a result, the health check operation is stopped and the normal control state is restored.

Therefore, according to this embodiment, there is no need to electrically short-circuit or disconnect the signal path from the plant, and mistakes such as erroneous connections and forgetting to restore can be prevented. Furthermore, since the evaluation is performed automatically, there will be no misjudgment.

Furthermore, the 1-system drive means 31 operated by the output of the 1-system control means 21 and the 2-system drive means 32 operated by the output of the 2-system control means 22 are connected in series and inserted into the power supply circuit of the actuator 101. Therefore, unless the first system control means 21 and the second system control means 22 are operated at the same time, the device 100 will not actually operate. Therefore, there can be no adverse effect on the plant P due to the operation of the equipment 100 for safety confirmation.

Furthermore, when a change occurs in the status signals P1, P2 of the plant P and the operation switch signal S1 of the man-machine device 1 during the health check, the health check operation is stopped and the normal control operation is resumed. Because of this, it is possible to perform safe control without delaying normal plant requests even during health checks.

Although the above embodiments were applied to plants, it goes without saying that the present invention is not limited to this and can be applied to most controlled systems including plants.

[0037]

Effects of the Invention As is clear from the above explanation, according to the present invention, since the creation of a simulated input signal and the operation confirmation are automatically performed, it is possible to prevent erroneous operations and erroneous recognition, and to easily improve soundness. can be confirmed. Further, even during actual operation of the controlled system, the safety control function is not impaired and the controlled system is not affected in any way, so it can be applied to a wide range of controlled systems.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing the configuration of an embodiment of the present invention.

FIG. 2 is a block diagram showing the configuration of a conventional digital control device.

[Explanation of symbols]

1 Man-machine device 13 Signal generation means 15 Soundness confirmation means 21 1 system control means 22 2nd system control means 31 1-system drive means 32 2nd system drive means 41 1 system monitoring means 42 2nd system monitoring means 100 Equipment 101 Actuator P Plant

Claims (2)

[Claims] 1. A digital control system that uses a microprocessor to control a device for changing the state of a controlled system to a safe side, which outputs an operation request signal for the device and a request signal for confirming the soundness of the digital control. and a man-machine device that inputs a health evaluation signal and displays a health check result, and a signal generating means that outputs a simulated input signal that simulates an operation request for the device and a state change of the controlled system. , inputting the operation request signal and the state signal of the controlled system, and switching and inputting a simulated input signal output from the signal generating means when a health confirmation request signal is output from the man-machine device; a first and a second drive signal for the device, each outputting a drive signal for the device based on a logical operation;
a control means, a drive means for driving the device according to an AND condition of each drive signal of the first and second control means, a monitoring means for monitoring the state of the drive means, and an output signal of the monitoring means. and a soundness evaluation means for comparing the soundness of the control means with the simulated input signal and applying an evaluation signal to the man-machine device. 2. The presence or absence of a change in an operation request signal for the device and a state signal of the controlled system is detected, and when a state change is detected during a health check based on the simulated input signal, a health check operation is performed. 2. The digital control system according to claim 1, further comprising state change detection means for stopping the operation.