JPH0543121B2 - - Google Patents

Description

[Detailed description of the invention]

[Field of Application of the Invention] The present invention relates to a plant control device, and in particular to a small and economically efficient plant suitable for application to a control system that requires high reliability, such as a water supply control system in a nuclear power plant. Regarding a control device. [Background of the invention] As a conventional plant control device, for example,
There is one described in Publication No. 59-212902. In this conventional technology, a subsystem includes an information processing device that calculates a control signal by processing acquired process information, a process input device that takes in the process information, and a process input device that outputs the control signal to a controlled object. By providing three sets of systems, a triplex system is constructed. This conventional technology achieves high reliability by multiplexing the common parts of the multiplex system, but on the other hand, the wiring connections are complicated and the amount of hardware is large, making the equipment larger and taking up less space. There is a problem in that it is disadvantageous in terms of performance and costs are also high. Furthermore, in this conventional technology, the above-mentioned subsystems are the constituent units, so in the case of a triplex system, for example, if a process input device or process output device of a subsystem fails, the entire subsystem becomes unusable. I end up. In other words, the triplex system becomes a doublex system, and the high reliability of the triplex system cannot be utilized. Process input devices and process output devices have a large number of connection points with the plant side that is to be controlled, and have a high failure rate. Therefore, unless measures are taken to prevent this,
There is a problem in that the high reliability of the multiplexed system makes it impossible to constantly control the plant. [Objective of the Invention] The object of the present invention is to maintain a multiple system of information processing equipment as long as the information processing equipment that oversees control does not fail, and to constantly perform highly reliable plant control, and to create a small and inexpensive plant. The purpose is to provide a control device. [Summary of the Invention] The above object is to provide a plurality of distributed process input devices into which a plurality of pieces of process information are input, and to generate a control signal by processing the process information taken in from the plurality of process input devices. and a plurality of distributed process outputs that take in control signals output from the plurality of information processing devices, process them based on predetermined logic, and output them as plant control signals. This is achieved by providing a plurality of data transmission paths for connecting each information processing device to the plurality of process input devices and the plurality of process output devices. In the present invention, a plurality of process input devices and a plurality of process output devices are arranged separately from an information processing device, and an information processing device is provided with a plurality of distributed process input devices and a plurality of process output devices. Since the configuration is such that each of the information processing devices is connected through an independent data transmission path, a multiplex system of the number of information processing devices is maintained as long as the information processing device does not fail. [Examples] Hereinafter, the present invention will be described in more detail with reference to Examples shown in the accompanying drawings. FIG. 1 is a block diagram showing one embodiment of the present invention. As shown in the figure, a central processing unit 100
consists of three CPUs 1, 2, and 3, and has a triplex configuration. On the other hand, the process input/output unit 200 includes four process input devices 11,
12, 13, 14 and 4 process output devices 1
It consists of 5, 16, 17, and 18, and is installed in a distributed manner. That is, the central processing unit is multiplexed (redundant), and the process input/output unit 200 has a decentralized, multi-distributed system configuration. The CPUs 1, 2, and 3 of the central processing unit 100 are
As shown in the figure, data transmission lines 4, 5, and 6 are connected in a loop. Also, each CPU1, 2, 3
The process input devices 11, 12, 13, 14 and process output devices 15, 16, 17, 18 of the process input/output section 200 are connected by data transmission paths 7, 8, 9 as shown in the figure. has been done. Various process information (e.g., temperature, pressure, flow rate, on/off signals, etc.) output from a plant (not shown) to be controlled is captured by process input devices 11, 12, 13, and 14. . Here, when the plant information is a numerical value important for control, different plant information of the same type detected by a plurality of detectors is taken into each process input device. For example, when inputting pressure as plant information, each process input device 1
1, 12, 13, and 14 for redundancy. Various types of plant information input to the process input devices 11, 12, 13, and 14 are transmitted to the central processing unit 100 via data transmission paths 7, 8, and 9.
It is taken into CPU1, 2, and 3. The central processing unit 100 processes input process information according to predetermined logic, algorithms, etc., and calculates a plurality of control signals. These control signals are sent to process output devices 15, 16, 17, 18 via data transmission lines 7, 8, 9. Each process output device 15, 16,
17 and 18 include a triplexed central processing unit 1
A plurality of control signals from 00 are input, and each process output device 15, 16, 17, 18 outputs a predetermined signal such as "2 out of 3 logic" or "intermediate value selection logic" from these plural control signals. According to logic and algorithms, the control signal estimated to be the most correct is calculated or selected and output. According to this configuration, even if a failure occurs in one of the three CPUs 1, 2, and 3 in the central processing unit 100, as long as the remaining two are operating normally, the control The signal will not become abnormal. Also, even if an error occurs in yet another CPU,
As the signal calculation logic of the process output device, by using an algorithm that uses the control signal from the remaining CPU as the output signal, the
The output signal will not become abnormal. That is, even if two of the three CPUs 1, 2, and 3 of the central processing unit 100 go down, control can be continued. Further, as described above, important plant information related to control is multiplexed (redundant) and input to each process input device 11, 12, 13, and 14 in a distributed manner. Therefore, even if an abnormality occurs in one of the four process input devices 11, 12, 13, and 14, control will not become impossible to continue. Of course, if you provide more than triple redundancy for important process information, even if a double failure occurs, including trouble with the signal source,
Since at least one piece of normal process information is sent to each central processing unit 100, control can be continued. As will be described later, the above-mentioned process information redundancy method is not necessarily limited to making the same process information redundant, but rather uses similar information to You may also use a method that can be estimated using . Note that if the input process information has a redundancy level of triple or higher, even if two of the four process input devices 11, 12, 13, and 14 fail, the remaining normal process input circuits can be used. Process information can be captured via the Therefore, even if two of the process input devices 11, 12, 13, and 14 go down, control can be continued. In addition, each CPU 1 in the central processing unit 100,
Even if an abnormality occurs in the data transmission lines 4, 5, and 6 that connect the devices 2 and 3 and they become unable to communicate with each other, the mutual diagnostic function will not be able to be performed, but the control function of the control device will not be affected. I won't give it. By the way,
If a trouble occurs in the data transmission line 6 connecting the CPU 1 and the CPR 3, mutual diagnosis function can be ensured by allowing data to be exchanged between them via the CPU 2. Furthermore, since the data transmission paths 7, 8, and 9 between the central processing unit 100 and the process input/output unit 200 are completely independent, they can operate as a single system if at least one data transmission path is normal. Therefore, there is no problem in terms of control. In addition, process output devices 15, 16, 17, 1
8 is also a circuit that outputs a control signal to the controlled object. Therefore, if a problem occurs in one of them, the normality of the control signal to that controlled object is no longer guaranteed, and there is a high possibility that the control function as a whole will be impaired. Therefore, if necessary (for control signals considered to be important for plant operation), the configuration is such that the same control signal can be output to other adjacent process output devices, and these two
Switching circuits 31 and 3 provided with two control signals externally
It is designed so that it can be switched between 2, 33, and 34. As a result, the process output devices 15, 16,
Even if one of the units 17 and 18 breaks down, no problem will occur in terms of control. Moreover, by effectively utilizing the system redundancy of the controlled system itself, it is possible to further strengthen fault tolerance. Next, a specific example will be described in which the plant control device according to the present invention is applied to a BWR nuclear power plant water supply control system. FIG. 2 is a diagram showing an overview of the water supply control system of the BWR nuclear power plant. This water supply control system is installed to maintain the reactor water level at a preset value, and is a particularly important control type among the plant control systems of BWR nuclear power plants. In FIG. 2, 101 is a reactor water level detector for detecting the water level of the reactor 120, and 102 is a main steam pipe 12 connecting the reactor 120 and the condenser 121.
a main steam flow rate detector that detects the amount of steam flowing through 2;
103 is a water supply flow rate detector that detects the flow rate of water flowing through the water supply piping to the nuclear reactor 120. here,
Although not shown, the reactor water level detector 101 has three
There are several. In addition, the main steam pipe 122 has 4
One main steam flow detector 10 for each
2 is provided. Further, two water supply pipes are provided, and two water supply flow rate detectors 103 are provided for each pipe. Therefore, three reactor water level signals, four main steam flow rate signals, and four feedwater flow rate signals are input to the feedwater control system 104. The water supply control system 104 has the configuration shown in FIG. 1, and FIG. 2 shows a block diagram showing an outline of its control operation. That is, the feedwater control system 104 takes in the above-described reactor water level signal, main steam flow rate signal, and feedwater flow rate signal, and performs proportional-integral control 105 based on the deviation from the reactor water level set value. The output of the proportional-integral control 105 is applied to the turbine-driven water supply pumps 110, 111 and water supply regulating valves 112, 113, which are to be controlled, via a lower controller or manual/automatic switch 106 to 109, and is applied to the turbine-driven water supply pumps 110, 111 and water supply regulating valves 112, 113, respectively, which are controlled by the turbine. The rotation speed and the opening degree of the water supply adjustment valve are controlled. Now, in a typical BWR nuclear power plant, the turbine-driven water pumps 110 and 111 are 55
%, motor-driven water pumps 114 and 115 are 27.5
It has a capacity of %. When starting or stopping the plant, the motor-driven water supply pumps 114 and 115 are started and used, but in normal operating conditions, the two turbine-driven water supply pumps 110 and 111 are operated, and the two
The motor-driven water supply pumps 114 and 115 are in a standby state. In the unlikely event that the turbine-driven water supply pump 1
10, 111 trips, the motor-driven water supply pumps 114, 115 are automatically activated almost instantaneously to prevent a decrease in the water supply flow rate. In this way, for a system in which two motor-driven water pumps are installed as a backup for one turbine-driven water pump, it is possible to combine the output signal configurations of the multiplex distributed control device as described below. , a dramatic improvement in fault tolerance can be achieved. Table 1 shows the process input device 1 shown in FIG.
1, 12, 13, and 14. As described above, the reactor water level signal, main steam flow rate signal, and feed water flow rate signal input to each process input device 11, 12, 13, and 14, respectively, are detected by different reactor water level detectors and different main steam flow rate signal detections. The outputs from different water supply flow rate detectors are multiplexed and have a high degree of redundancy.

[Table] Table 2 shows the process output device 1 shown in Figure 1.
5, 16, 17, and 18. In Table 2, normally a positive control signal is output by the switching circuits 31, 32, 33, and 34 shown in FIG. Ru.
In Table 2, TD means a turbine-driven water pump, and MD means a motor-driven water pump.

[Table] As shown in Tables 1 and 2, by assigning process information and control signals, two of the four process input devices 11, 12, 13, and 14 failed, and four process output device 15,1
Even if two of the units 6, 17, and 18 fail, control can continue. For example, the process input device 11,
A case where the process output device 12 and the process output devices 15 and 16 are out of order will be explained. At this time, the signal input to the process input device 13 is used alone as the reactor water level signal, and the total main steam flow rate and the total feed water flow rate are determined by the main steam flow rate signal input to the process input devices 13 and 14, Calculated from the water supply flow rate signal. In addition, as for the control signal, since the control signal for the turbine-driven water supply pump (for 110) has been lost, the same pump is tripped, and the turbine-driven water supply pump 111 and the motor-driven water supply pump 114,
By placing the three pumps 115 under the control of the water supply control system 104, the water level of the reactor 120 is stably controlled. Note that, similarly to the above case, if the process input devices 11, 13 and process output devices 15, 17 are out of order, the necessary process information is not provided by the process input devices 12, 14 and process output devices 16, 18 There is no need to trip a single turbine-driven feedwater pump, as the system is secured and no control signals are lost. The other cases are similar to the above two cases, and control can be continued even if two of each of the process input devices 11 to 14 and the process output devices 15 to 18 fail. As is clear from the above description, according to this embodiment, it is possible to maintain the control function continuously even in the event of the occurrence of the following abnormality, and it is possible to construct an extremely reliable system with high fault tolerance. (b) Central processing unit 100 Operation can continue even if two out of three CPUs fail. (b) Operation can be continued even if two of the three data transmission lines in the central processing unit 100 are abnormal. (c) Process input/output devices Operation can be continued even if two of the four process input devices and process output devices are abnormal. (d) Data transmission line between the process input/output device and the central processing unit Can operate even if there is an error in the data transmission line of two out of three units. Furthermore, even if the troubles (a) to (d) above occur in combination, control can be continued in most cases. In addition, in the worst case, the central processing unit 100
As long as one CPU, one data transmission path connecting it to the process input/output device, two process input devices, and two process output devices are in normal condition, the control function is secured. Note that in the above embodiment, the central processing unit 100
Although the description has been made assuming that three CPUs are provided within the device (triplex), four process input devices, and four process output devices, it goes without saying that each of these devices may have any value. According to the embodiments described above, a system with extremely high fault tolerance can be constructed in a small size and at low cost. Specifically, although it varies slightly depending on the target control system, the number of input points of the process input circuit is reduced to 1/3 to 1/2 compared to the method described in the known example, and the number of output points is reduced. However, even if all points have backups, it will be reduced to 2/3, and if only particularly important control signals have backups, it will be reduced by 1/3 to 1/3.
Reduced by 1/2. In addition, the control signal switching circuit is
Instead of selecting one point out of three points, the method selects one of two points, so the number is reduced to less than 1/2. Therefore, overall, depending on the system scale, it is possible to reduce the size by about 50% at the level of a BWR nuclear power plant water supply control system. [Effects of the Invention] According to the present invention, it is possible to construct a plant control device that is small, inexpensive, and has extremely high fault tolerance.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing one embodiment of the present invention;
FIG. 2 is a block diagram showing a specific example in which the present invention is applied to a water supply control system of a BWR nuclear power plant. 1, 2, 3...CPU, 4, 5, 6, 7, 8, 9
...Data transmission path, 11, 12, 13, 14... Process input device, 15, 16, 17, 18... Process output device, 31, 32, 33, 34... Switching circuit, 100... Central processing unit, 101... Atom Reactor water level detector, 102...Main steam flow rate detector, 103...
Water supply flow rate detector, 104... Water supply control system, 105...
Proportional-integral control, 106-109...manual/automatic switch, 110, 111...turbine-driven water supply pump,
112, 113... Water supply adjustment valve, 114, 115...
Motor-driven water supply pump, 120... Nuclear reactor, 121
...Condenser, 200...Process input/output unit.

Claims (1)

[Scope of Claims] 1. A plurality of distributed process input devices into which a plurality of process information is input, and a control signal is obtained by processing the process information taken in from the plurality of process input devices. a plurality of information processing devices that output information, and a plurality of distributed process output devices that take in control signals output from the plurality of information processing devices, process them based on predetermined logic, and output them as plant control signals; . A plant control device, characterized in that each information processing device is provided with a plurality of data transmission paths connecting each information processing device to the plurality of process input devices and the plurality of process output devices. 2. A plant control device according to claim 1, characterized in that the plurality of process input devices are configured to separately input the outputs of a plurality of detectors that detect the same type of process information. . 3. A plant control device according to claim 1 or 2, wherein each process output device is configured to output an individual control signal to a control target corresponding to the device itself. 4 In claim 3, the control signal given to the control target important for plant operation is configured so that the same control signal as the control signal can be output from other process output devices, and the control signal is given to the control target important for plant operation. 1. A plant control device comprising: a switching circuit that provides a control signal output from the other process output device to the controlled object when a process output device that outputs a control signal to the other process output device fails. 5. A plant control device according to any one of claims 1 to 4, characterized in that the plurality of information processing devices are connected by a transmission path for mutual communication.