JPH0473162B2 - - Google Patents

Description

TECHNICAL FIELD OF THE INVENTION The present invention relates to multiplexed process control devices for controlling process conditions.

[Technical background of the invention and its problems] In recent years, in process control devices that require high reliability, multiplexing configurations such as duplication and triplexing have been adopted to improve the reliability of the control device. Things are becoming more and more common.

To multiplex a process control device, there are two methods: to have a regular controller and a standby controller, and switch to the standby controller if the regular controller fails, and to operate multiple controllers at all times and A method is known in which the output of a controller is selected by majority vote and output.

In the former method, a failure detection circuit that determines whether the controller is normal or abnormal is essential, but determining whether the controller is normal or abnormal is complicated and difficult. In addition, switching from the regular controller to the standby side is performed when the failure detection circuit determines that there is an abnormality.
If a failure that cannot be detected by the failure detection circuit occurs, no switching operation is performed and the output to the process becomes abnormal. Furthermore, as the failure detection ability of the failure detection circuit increases, the failure detection circuit itself becomes more complex, and failures of the failure detection circuit itself become a problem.

On the other hand, in the latter method, the output is selected by majority vote, so at least three controllers are required, but a failure detection circuit for determining whether the controllers are normal or abnormal is not required. Furthermore, when the controllers are triplexed, the majority circuit can be easily configured with an intermediate value selection circuit if the output of the controller is an analog quantity, and a 2outof3 logic circuit if the output of the controller is a binary digital quantity. At this time, it goes without saying that even if one controller fails, the output of the process control device is maintained normally.

For this reason, control devices based on the latter method are often used to control processes that require particularly high reliability, such as nuclear power plants.

FIG. 5 shows a conceptual diagram of a triplexed process control device. In FIG. 5, the process 1 to be controlled includes three controllers 2A, 2
Among the output signals S _1A , S _1B , and S _1C of B and 2C, the value selected by the selection circuit 3 is outputted as the output signal S ₂ of the process control device 4. In the case of triplexed controllers, the selection circuit 3 is composed of an intermediate selection circuit or a 2outof3 logic circuit, but from now on, we will discuss the selection circuit 3 as an intermediate value selection circuit for triplexed process control equipment. Proceed. Of course, it goes without saying that the same thing applies to triple or more process control devices.

In the triplex process control device 4, controllers 2A,
Even if any one of the controllers 2B and 2C fails, the output signal S ₂ of the process control device 4 is normal, so the function of the control device can be maintained without interruption. Higher reliability can be achieved compared to . However, the triplexed controllers 2A, 2
The intermediate value selection circuit 3 provided for the purpose of keeping the output of the process control device 4 normal even if one of B and 2C fails is a single layered intermediate value selection circuit 3. Therefore, if the reliability of the intermediate value selection circuit 3 is not sufficient, not only will there be no point in multiplexing the controllers, but the intermediate value selection circuit 3 will reduce the reliability of the entire process control device 4. A problem arises.

[Object of the Invention] An object of the present invention is to provide a highly reliable process control device that can solve the above problems and always provide a normal output to a process.

[Summary of the Invention] For this reason, the present invention adds a diagnostic circuit to the majority circuit to detect a failure by monitoring the signal of the majority circuit that selects the output of a multiplexed controller, and detects a failure in the majority circuit. In addition, this majority circuit is multiplexed and an output switching circuit is installed so that a normal majority circuit is always selected as the output of the process control device based on the output of the diagnostic circuit, thereby increasing the reliability of the process control device as a whole. It is characterized by being designed to enhance sex.

[Embodiments of the Invention] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 shows a configuration diagram of a process control device according to an embodiment of the present invention. In the figure, the same reference numerals as in FIG. 5 indicate the same or corresponding parts, and the difference from the conventional configuration in FIG.
A, 3B, and the selection circuits 3A, 3B.
is composed of intermediate value selection circuits 5A, 5B and diagnostic circuits 6A, 6B that check whether it is normal or abnormal;
Relay 7 and its contact 7 that switches the outputs S _3A and S _3B
A switching circuit consisting of A and 7B is provided, and
The point is that a display 8 is provided which is energized by the diagnostic circuit 6B.

With this configuration, process 1 to be controlled has 3
Output signals S _1A of the controllers 2A, 2B, 2C,
The signal selected by the intermediate value selection circuits 5A and 5B among S _1B and S _1C is outputted as the output signal S ₂ of the process control device 4. Here, the intermediate value selection circuit 5A,
The output of the circuit 5B is monitored by the diagnostic circuits 6A and 6B, and its failure is detected. User side selection circuit 3
If A is operating normally, the diagnostic circuit 6A
No failure is detected in the output of the diagnostic circuit 6A.
_S4A becomes "0" and relay 7 becomes de-energized.
Therefore, contact 7B of relay 7 is ON and contact 7A is ON.
Since it is turned off, the output signal _S3A of the intermediate value selection circuit 5A becomes the output signal _S2 of the process control device 4.

Next, when a failure in the intermediate value selection circuit 5A is detected by the diagnostic circuit 6A of the selection circuit 3A on the user side, the output S _4A of the diagnostic circuit 6A becomes "1",
Energize relay 7. When relay 7 is energized,
Since contact 7B of relay 7 is turned OFF and contact 7A is turned ON, switching to the selection circuit 3B on the standby side is performed, and the output signal of the intermediate value selection circuit 5B on the standby side is
S _3B becomes the output signal S ₂ of the process control device 4.

In this way, even if the intermediate value selection circuit 5A on the use side fails, the diagnostic circuit 6A detects the failure and switches to the intermediate value selection circuit 5B on the standby side.
The output signal _S2 of the process control device 4 can be maintained normally.

Furthermore, even if the diagnostic circuit 6B detects a failure in the intermediate value selection circuit 5B on the standby side at this time, if the intermediate value selection circuit 5A on the use side is normal, the output signal S ₂ of the process control device 4 will be can maintain normality. In this case, the failure of the intermediate value selection circuit 5B on the standby side can be recognized by displaying on the display 8 that the intermediate value selection circuit 5B has failed using the output signal _S4B of the diagnostic circuit 6B. .

FIG. 2 shows the intermediate value selection circuit 5A and the diagnostic circuit 6.
A conceptual diagram of an embodiment of a selection circuit 3A consisting of A is shown. As shown in the figure, the intermediate value selection circuit 5A of this embodiment uses multiplexed controller output signals.
Low value selection circuits _9A , 9B receiving S _1A , S 1B, S _1C ,
9C and a high value selection circuit 10A that receives the output signals S _5A , S _5B , and S _5C . On the other hand, the diagnostic circuit 6A uses the outputs S _5A , S _5B ,
In response to _S5C and the output _S3A of the high value selection circuit 10A, it is determined whether the intermediate value selection circuit 5A is normal or abnormal, and if a failure is detected, the diagnostic circuit output signal _S4A is set to "1" and the relay is energized.

Normality of intermediate value selection circuit 5A in diagnostic circuit 6A,
Abnormality is determined by the low value selection circuit output signals S _5A , S _5B ,
This is done by comparing the values of _S5C and the high value selection circuit signal _S3A . That is, the low value selection circuit output signal S _5A ,
If all three values of S _5B and S _5C are different, it is assumed that one of the low value selection circuits 9A, 9B, and 9C is malfunctioning. In addition, the low value selection circuit output signal S _5A ,
If any two values of S _5B and S _5C are equal,
If the value of the remaining one low value selection circuit output signal and the value of the high value selection circuit output signal _S3A are different, the high value selection circuit 1
It is considered as a 0A failure.

When a failure is detected in the diagnostic circuit 6A through the above diagnosis, the relay 7 is energized to disconnect the output S _3A of the intermediate value selection circuit 5A, and disconnect the output S _3B of the other normal intermediate value selection circuit 5B. Switch to

FIG. 3 shows an example of the diagnostic circuit 6A. As shown in the figure, the diagnostic circuit 6A outputs the low value selection circuit output signal.
A comparison circuit 11 which receives two signals among S _5A , S _5B , S _5C and the high value selection circuit output signal S _3A , an inverter element 12 which inverts the output of the comparison circuit 11 , and an inverter element 12 or the comparison circuit 11 . AND elements 13A to 13D whose outputs are input;
It is composed of an OR element 14 which receives all the outputs of AND elements 13A to 13D as inputs. Here, if the values of the two signals are equal, the comparator circuit 11 outputs "0".
and if different, outputs “1”. The output of the comparator circuit 11 is output as it is or after being inverted by the inverter element 12, the output is sent to the AND elements 13A to 13A.
3D input, and the AND elements 13A to 13D determine whether the low value selection circuit output signals S _5A , S _5B , S _5C and the high value selection circuit output signal S _3A are normal or abnormal.
That is, since the AND element 13A inputs all combinations of comparisons of two signals among the low value selection circuit output signals S _5A , S _5B , S _5C , the low value selection circuit output signals S _5A , S _5B , If the values of S _5C are all different,
The output of the AND element 13A becomes "1", and a failure of the low value selection circuit can be detected. Also, AND element 1
3B, when the values of the low value selection circuit output signals S _5A and S _5B are equal, if the high value selection circuit output signal S _3A is normal, it will be equal to the low value selection circuit output signal S _5C , but,
If they are not equal, the output of AND element 13B is “1”
Therefore, a failure in the high value selection circuit can be detected. Similarly, in the AND element 13C, when the values of the low value selection circuit output signals S _5B and S _5C are equal, the AND element 13C
In D, it is possible to detect a failure in the high value selection circuit when the values of the low value selection circuit output signals S _5C and S _5A are equal. The outputs of the AND elements 13A to 13D are input to the OR element 14, and if any one of the AND elements 13A to 13D detects a failure, the diagnostic circuit output signal becomes "1".

As described above, the selection circuit 3A is configured by adding the diagnostic circuit 6A for detecting a failure to the intermediate value selection circuit 5A, and monitors the output of the intermediate value selection circuit 5A. By switching to another multiplexed selection circuit 3B, a normal control signal can always be transmitted to the process. In addition, since the mean time to repair (MTTR) of the intermediate value selection circuit is generally sufficiently smaller than the mean time to failure (MTBF), there is no need to consider simultaneous failures of the intermediate value selection circuit, and furthermore, it is necessary to switch the intermediate value selection circuit. Since the relay section used in this process has a simple structure, its reliability can be made extremely high, so that the reliability of the process control device can be made extremely high.

In the above embodiment, the case where the selection circuit 3 is duplicated is explained, but for example, as shown in FIG. 15A,
By adding a switching circuit consisting of 15B,
A triplex configuration can be used. It goes without saying that a multiplexed configuration such as a quadruplex configuration can be similarly adopted.

Further, in the above embodiment, an example was shown in which the switching circuit was configured using a relay, but it is of course possible to configure the switching circuit using a semiconductor element such as an FET and a circuit.

Furthermore, in the above embodiment, an example was explained in which the intermediate value selection circuit was configured with three low value selection circuits and one high value selection circuit, but this could be replaced with three high value selection circuits and one low value selection circuit. Of course, even if the intermediate value selection circuit is configured with a value selection circuit, the same effects as those of the above embodiment can be obtained.

In addition, in the above practical example, an intermediate value selection circuit was used as the majority circuit, but it goes without saying that a majority logic circuit may also be used in the case of a digital signal.

[Effects of the Invention] As described above, according to the present invention, the selection circuit for selecting the output of a multiplexed controller is configured with a majority circuit and its diagnostic circuit, and when a failure is detected by the diagnostic circuit, the majority decision By switching the circuits, not only the controller but also the selection circuit for selecting its output can be multiplexed, and the reliability of the process control device can be greatly improved.

[Brief explanation of the drawing]

FIG. 1 is a conceptual diagram of a process control device according to an embodiment of the present invention, FIG. 2 is a conceptual diagram of an embodiment of the selection circuit of FIG. 1, and FIG. 3 is a conceptual diagram of an embodiment of the diagnostic circuit of FIG. FIG. 4 is a conceptual diagram of a process control device according to another embodiment of the present invention, and FIG. 5 is a conceptual diagram showing the configuration of a conventional multiplexed process control device. 1... Process, 2A, 2B, 2C... Controller, 3A, 3B, 3C... Selection circuit, 4... Process control device, 5A, 5B, 5C... Intermediate value selection circuit, 6A, 6B, 6C... ...Diagnostic circuit, 7...Relay, 8...Display device.

Claims (1)

[Claims] 1. A process control that includes a plurality of controllers that input the same signal and perform the same processing, and a selection circuit that selects and outputs a normal output signal from among the output signals from each of these controllers. In the device, a plurality of selection circuits are provided, each consisting of a majority circuit and its diagnostic circuit, and one of the selection circuits is selected to obtain a control output, but the diagnosis circuit in the selection circuit detects a failure. 1. A process control device comprising a switching circuit that switches to a next-stage selection circuit when the selection circuit is selected. 2. The process control device according to claim 1, wherein the majority circuit is an intermediate value selection circuit. 3. The process control device according to claim 1, wherein the majority circuit is a majority logic circuit.