JPH0756601B2 - Plant control equipment - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a plant control device, and more particularly to a drive control module (hereinafter referred to as DCM) suitable for the configuration of a system equipment unit distributed control system.

[0002]

2. Description of the Related Art Conventionally, a sequence control device has been constituted by a relay or a solid state wired logic. However, as the system becomes more sophisticated and complex due to wide-ranging automation that enables plant operation by a small number of people and the increase in the number of plant auxiliary equipment due to the increase in coal-fired power generation plants accompanying fuel conversion, the amount of hardware and wiring The number is enormous. Further, it has been difficult to meet advanced needs such as sequence progress display, traffic jam display, and abnormality diagnosis.

In recent years, CP has replaced wired logic.
Digital controllers or sequence control devices having U as a core have been widely used. However, the digital controller has a configuration in which a single controller performs time-division processing on a plurality of devices for economical reasons. Therefore, CP
In the event of a U failure, the control of multiple devices will become impossible and a serious obstacle will occur to the continuation of plant operation.
Multiplexing of the controller is required.

In a situation where the equipment is damaged when the operation is continued, an interlock for forcibly stopping the equipment to ensure safety (hereinafter referred to as equipment protection interlock) is required. This is composed of hard-wired logic even when a conventional digital controller is used. This is because the device protection logic must always be configured during the operation of the device regardless of the operation / non-operation of the CPU.

FIG. 2 shows the configuration of a conventional controller using a digital controller. Reference numeral 1 is a digital controller, which is composed of a CPU 2 and digital input cards 3a to 3n (hereinafter DI cards), digital output cards 4a to 4n (hereinafter DO cards), and a PI / O bus 7. Reference numeral 8 is a backup circuit for performing equipment protection, alarms, manual operations, etc., and by a command from the manual operation switch shown in 9 and a process status signal from the plant,
When the digital controller 1 fails, the operating end is manually controlled so that the plant operation can be continued. Furthermore, in a situation where the plant is damaged, the equipment is forcibly stopped to ensure plant safety. is there. Reference numeral 11 denotes a device, which constitutes a plant with a plurality of devices. Normally, one digital controller 1 controls a plurality of device groups 10.

FIG. 3 shows the digital controller 1 shown in FIG. 2 in more detail. Reference numeral 20 is a circuit executed by software stored in the memory in the CPU 2. These circuits are described in the macro language indicated by 21, 22, and 23. Reference numeral 21 is a logical sum macro, 22 is a logical product macro, and 23 is a logical negation macro. Reference numeral 26 is a sequential control logic, which describes the sequential control processing contents in a macro language using the sequential drive command 24, the sequential stop command 25, and the process state signals 27a to 27n, which are predetermined while confirming the process state. Automatic start commands 28a to 28n and automatic stop commands 29a to 2 to each device according to the order.
9n is output from DO.

Reference numeral 80 denotes one device of the backup circuit 8, and its logic circuit is composed of a wired logic. When the automatic mode is selected by the automatic / manual changeover switch 92, the commands from the manual operation switches 91 and 93 are locked by the AND circuit 81, and the automatic operation output 28 from the digital controller 1 is generated.
After selecting a and 29a and checking the process state signal 85, the operating end 12 is automatically operated. On the other hand, when the manual mode is selected, the process is performed while checking the process state signal 85 according to the operation of the manual operation switches 91 and 93. Further, the protective interlock of 87 is provided at the detecting ends 14, 1
When the abnormal state of the device is detected in 5, the abnormal state is determined by taking in the abnormal state signals 86a to 86n, and the stop command is forcibly output with the highest priority over any operation command, It ensures the safety of the equipment.

FIG. 4 shows a front view and a side view of a conventional sequence controller using a digital controller. 100 is a system cabinet of the control device, 101
Is a control power supply device, 102 is an input / output cable of the digital controller 1, and 8 is an auxiliary equipment protection, alarm and manual operation circuit composed of an electromagnetic relay 103 and the like. Reference numeral 104 is a wiring for constructing a circuit by combining electromagnetic relays, 105 is an external terminal block, and 106 is an external cable, which is connected to the plant.

A known example of such a conventional system is described in the Institute of Electrical Engineers of Japan, October 1981, Vol. 101, No. 10, "Full automation of thermal power plants-its trends and prospects", P15 and FIG.

[0010]

In the conventional plant control system, since a single digital controller centrally controls a plurality of devices, the operation of the plurality of devices is hindered when the controller fails. There was a defect that the abnormality of the device of 1 spread to other devices of the group. In addition, since the manual operation circuit and protection interlock circuit provided as measures against this are configured by hard-wired logic for each device, hardware of the same scale as a digital controller or more and a huge number of wirings are required, It was a great way to build a large-scale system such as a power plant.

An object of the present invention is to provide a plant control device equipped with a simple DCM that can operate autonomously even when the CPU is abnormal and can prevent the spread of equipment accidents.

[0012]

SUMMARY OF THE INVENTION The present invention is a plant control device for controlling the operation of a plurality of equipments forming a plant or a predetermined part thereof, and is required for each equipment in order to integrally control the plurality of equipments. C that calculates various control command signals
PU, a plurality of DCMs provided independently between the CPU and the plurality of devices corresponding to each of the plurality of devices, and PI / serving as a signal transmission path between the CPU and the plurality of DCMs. The DCM includes an O bus, the DCM is an input / output unit for inputting a plurality of process signals of the corresponding device and outputting the control command signal, and a predetermined portion for forming a part of the process signal to indicate an abnormality of the corresponding device. When the status signal of 1 is received, the protection operation signal is directly output to the device via the input / output means.

Further, the DCM is formed on a separate substrate and can be exchanged independently of other DCMs.

Further, the protection means of the DCM represents a logical result corresponding to the combination of the input signals at an address position designated by a combination of the input section composed of an address bus and the input signals of the input section. It has a storage section for storing predetermined data in advance and an output section composed of a data bus for outputting data at a designated address position, and a predetermined state signal indicating the abnormality is turned on to the input section to turn on between the input signals. When the predetermined combination is established, the protection operation signal is output to the output unit.

[0015]

The present invention is configured as described above, and the DCM has a built-in input / output unit and a device protection circuit for the number of signal points required to control one device, and if the abnormal state of the device is confirmed, C
A protection operation signal such as a forced stop command is output to the operation end directly from the protection circuit without passing through the PU. As a result, even in the case of a controller that controls a plurality of devices by one CPU, it is possible to prevent an accident ripple between the devices.

Further, since the DCM is detachably attached to the printed circuit board, individual maintenance can be performed when the DCM fails.

Furthermore, the protection circuit of the DCM uses the data indicating the logic result of each process stored in advance in the ROM or the like for the logic check up to the output of the protection operation signal. The address for reading the data in each process is specified by the presence or absence of a detection signal (particularly a signal indicating an abnormality) from the device and a sequential combination of a timer signal activated by the read data. Therefore, the forced stop command can be output only by the protection circuit without relying on the CPU after the logical check of the presence or absence of a plurality of signals and the elapse of time. As a result, a highly reliable protection operation can be realized with a simple hardware configuration mainly composed of a memory.

[0018]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows an example of the configuration of a system for carrying out one embodiment of a distributed control system for a plant by sequence control. In the figure, 11a to 11n are unit devices, 150a to 150n are device groups consisting of a plurality of devices 11, 151a to 151n are systems consisting of a plurality of device groups 150, and 152 is a plurality of systems. 151 is a power plant. 153a to 153
n is a DCM that has a one-to-one correspondence with the equipment 11a to 11n of the plant, and is composed of a single print card that includes an input / output unit required for controlling the corresponding equipment. Reference numeral 154 is a CPU that integrally controls a plurality of DCMs 153a to 153n, 155 is its PI / O bus, and 156a to 156n are device group controllers. Reference numeral 157 is a system controller that integrally controls a plurality of device group controllers 156a to 156n. An in-system serial signal transmission line 158 connects the system controller 157 and a plurality of device group controllers 156a to 156n. 159a-1
Reference numeral 59n is a system-based control system, and 160 is a master controller that integrally controls a plurality of system-based control systems 159a to 159n. A system serial transmission line 161 connects the master controller and a plurality of system controllers.

FIG. 5 shows details of the CPU 157 and the DCM 153. Reference numeral 200 is a functional block executed by software stored in the memory of the CPU 157. 201 is a hardware circuit realized by one DCM 153. 202 is a PI / O bus, and the CPU 157 connects the DCM 153a ...
Signals are transmitted and received in a time division manner with 153n.

Within the 200, there are circuits 203 to 206, and the control functions of the circuits are described in a macro language. The sequential automatic operation interlock 203 outputs the operation instruction to each operation end in the system while checking the state of the operation end when the automatic mode is selected. The operation permission interlock 204 determines from the input process state signal whether the operating end is operable. The automatic operation interlock 205 according to the external process condition determines whether or not the operating end is in an automatically operable state based on the input process state signal, and outputs an operation command if the automatic operation is possible. The operating end diagnostic circuit 206 is configured to input an operation command to the operating end and a status signal of the operating end,
A malfunction or non-operation of the operating end is determined, and an abnormal signal is output when an abnormality occurs.

The DCM card 201, which is composed of one printed circuit board, has 16 DI points for 250, 6 DO points for 251, basic logic for 252, protection logic for 253,
Built-in 254 logic pattern selector. DI, DO
The use of each channel is as shown in the figure. 25
The basic logic of 2 is the fixed minimum logic that is common to each operating end of the operating circuit and the status display circuit of the operating end, and is standardized as a fixed logic.
y Logic). The protection logic 253 is a logic for preventing equipment damage due to malfunctions and malfunctions, and is composed of a ROM.

Reference numeral 300 denotes an operator's operation unit including a manual operation switch and a status display lamp.

Reference numeral 12 is a motor for driving a device 13 at the operating end (a pump in this example), and 16 is a meta-cura and a power center including a circuit breaker for supplying power to the driving motor 12 and a control circuit for the circuit breaker. Is. Reference numeral 14 is a switch for detecting pressure and flow rate, and 15 is a limit switch for detecting the state and position of the equipment. Note that in the present embodiment, the unit called equipment (for example, 11a) refers to the equipment 13 (pump) at the operating end at the plant level.
In the direct relationship with the above, so-called auxiliary equipment including the control equipments 12 and 16 for operating the equipment 13 and the detection means 14, 15, 27 and 52 for the operating states of the operation end equipment and the control equipment corresponds to this.

FIG. 6 shows details of the protection logic 253.
This protection logic connects the memory address bus to the input,
The data bus is used as the output section, and the result of the planned logical operation based on the signal of the input section is stored in advance at the address location of the memory specified by the signal of the input section. The data is read and output.

In the configuration of FIG. 6, the address bus 402 of the storage device 403 serves as an input section and the output bus 404 serves as an output section. The logic pattern selection unit 254 selects a logical operation (result) required for protection of the device from a plurality of stored patterns. Note that if only the logic pattern dedicated to the device is stored, the selecting unit 254 is unnecessary. The data set by the selection unit 254 and the contact input signal 408 of the corresponding device 11i obtained from the DI unit 250 are input to the address bus 402, and the data of the address position of the storage device 403 designated by the combination of the input signals. Output bus 40
4 is output. A part of the output is input to the memory holding circuit 406 and the time delay operation circuit 407, and these hold signals and timer signals are fed back as input signals to the address bus 402. In this way, the storage device 403 is sequentially operated by the address corresponding to the combination of the input signals to be changed.
Read the data. As a result, when "1" is output to the device "OFF" command output end of the output unit 409, this signal forcibly stops the corresponding device via the basic logic 252 and the DO unit 251.

In FIG. 6, the logic pattern selection unit 254 is represented by 6 bits. In this case, 2 ⁶ = 64 patterns of logic can be selected. The number of bits may be selected as necessary, and for example, if 256 patterns of logic are required, it may be 8 bits. The input signal 408, the memory input signal 406, and the timer input 407 can also be changed in their scores within the input score range of the storage device 403 as needed. Although the storage device 403 is a ROM in FIG. 5, any of a RAM (Random Access Memory), a core memory, and the like can be used, and the logic to be configured is R.
It may be fixed by an OM or the like, or may be changed by a RAM, a core memory or the like.

The protection logic 25 configured as described above
3 is installed on the printed board as shown in FIG.
In the case where a state signal that damages the equipment, such as a decrease in the bearing oil pressure of No. 2 and a decrease in the inlet pressure of the pump 13, is input to the contact input 408 via the DI unit 250, a combination of such input signals is used. , Or a logical check such as the passage of time is sequentially performed, and a command to forcibly stop the equipment is output according to the data in the storage device 403 at a required time. Since this protection interlock does not go through the CPU, it operates reliably even when the CPU fails and the safety of the device is ensured, so that a highly reliable and flexible protection circuit is configured.

FIG. 7 shows a configuration of the protection logic 253 and a specific storage example of the storage device 403. In the example of the figure, for simplification, the logic pattern selection unit 254 is 3 bits, input 40
8 is 2 points, and the timer 405 is 2 points. An example of the logic pattern formed by this input is shown in FIG. 8, and the pattern number is 010. FIG. 9 shows a time chart based on this logic pattern. When the external input A is turned on (1) at t ₁ , the wire number 414 causes the timer T 1 to start timer counting. External input B is ON at t ₂ (1)
Then, the timer T2 similarly starts counting by the wire number 413. When external input B is turned on, A is also turned on, so output C is turned on via wire numbers 415 and 411.
(1) The status is output. Further, at time t ₄ when the timer T1 has completed counting, the output D is turned on via the wire number 412.
(1) The status is output.

A method of forming this logic pattern on the memory will be described below. MAD in the storage device 403 of FIG.
The part is a memory address, and the INF part represents the contents (data) stored in the address. The most significant 3 bits of the memory address MAD are given 1/0 by ON / OFF of the contacts 4, 5, 6 of the logic selection unit 254, and are [010] in the example of the figure. Also, M
The least significant 2 bits of AD represent timer inputs T ₁ and T ₂ , respectively. Further, the remaining 2 bits of MAD represent external input signals A and B.

(A1) to (A8) show 8 addresses which are determined by the combination of the data of A and B and the data of T ₁ and T ₂ in the case of the logic pattern [010]. For example, the external input signal A is “1”, B is “0”, T ₁ is “0”, T ₂
If is "1", the specified address is (A3) [0
101010]. Then, the content stored at the address position of (A3) becomes [1011], and this content pattern shows the preliminarily scheduled logical operation result for the input at this time point (t ₃ ).

Each bit of the content pattern [1011] is connected to a predetermined output line number by the data bus 404, and the upper bits 411 (output C) and 4 respectively.
Data is output to 12 (output D), 413 (T ₂ ) and 414 (T ₁ ). That is, output C is "1", output D
There "0", T ₁ is "1", T ₂ is "1" and the output C is output to the outside. Further, the timer T ₁ which starts counting with the input of T ₁ “1” has its output “1” at time t ₄ . The address specified in this input state is [0101011] in (A4), and the content pattern is [1111], so the output D is also "1".

In this way, for each address of the storage device 403, the outputs C and D and the outputs to the timers T ₁ and T ₂ are programmed according to a desired logic pattern, and are output corresponding to this program. The output unit may be any number within the range of the data bit of the memory.

FIG. 10 shows the details of the basic logic 252. Reference numeral 420 is a status display logic, and 450 is an operation command logic. In the input / output signals of the figure, the signal in the dotted frame is the input signal from the CPU, and the signal in the solid frame is the protection logic 2.
An input signal from 53 and a signal without a frame indicate an external input / output signal.

In the status display logic 420, the "ON" lamp lighting command output signal 441 of the output signal is logical OR 4
The output of 37. The logical sum 437 is the logical products 433 and 4
When either 35 or the lamp test signal 424 is ON, it is established and the signal 441 is output.

Therefore, if the control power supply normal signal 427 is in the "CPURUN" state when ON, the "ON" lamp lighting command 441 is output in accordance with the "ON" lamp lighting signal 422 from the CPU. On the other hand, in the "CPU stop state", the signal 422 from the CPU is locked by the logical product 433, and the "ON" lamp lighting command 441 is output by the "ON" feedback signal from the process. Further, the "off" lamp lighting command output signal 442 is also configured by the same logic.

The "automatic" lamp lighting command output signal 443 and the "manual" lamp lighting command output signal 444 are directly output by the ON / OFF state signal 428 of the automatic / manual mode selection switch. In this way, the process status display and the operation mode display necessary for the manual operation are taken in from the DI channel in the DCM card without the CPU when the CPU is stopped, and directly displayed via the status display logic 420.
It is output to the channel. Therefore, the display can be secured even when the CPU fails.

In the operation command logic 450, the "ON" command output signal 485 is output with the highest priority when the protection "ON" signal 451 which is an abnormal state signal requiring device protection is input by the logical sum 483. It

During normal operation, the protection logic 2
It is confirmed by the logical product 481 that the "ON" prohibition signal 452 which is the input from 53 is not established and the "ON" permission signal which is the input from the CPU is established. Moreover,
When the automatic mode is selected, the "ON" command 456 from the CPU is output, and when the manual mode is selected, the "ON" command output signal is output according to the operation signal 457 from the operation switch.

At the time of "CPU stop", the CPU
By the stop state signal 458 and the logical sum 477, CP
Since the "ON" permission signal 453 from U is bypassed, C
Manual operation and protection interlocks are protected regardless of the operating state of the PU.

FIG. 11 shows the connection between the protection logic 253, the status display logic 420 and the operation command logic 450. This is also a detailed view of the hardware circuit realized by one printed board in the DCM 201 shown in FIG.

Protection logic 253, basic logic 420
And 450, DI section 250, DO section 251, and PI / O
The bus 202 is connected as shown by mode wiring on the printed board. A process state signal for logically checking the protection interlock and permission conditions is input to the protection logic 253 via the DI unit 250, and the forced operation command output from the protection logic 253 is output from the OR gate. After being combined, they are input to the basic logic 450. In the basic logic 450, the protection logic 2
The forced operation command from 53 is given the highest priority over any of the manual operation command and the automatic operation command from the CPU, and the DO unit 251.
Is output from.

The operation command from the manual operation switch 300 and the status feedback signal of the equipment are both CP.
D is input directly from the DI unit 250 to the basic logic of 450 and 420 without going through U, and after performing a predetermined logical operation, D
It is output from the O section 251 to the indicator light 300 and the operation end.

On the other hand, the external signal input from the DI unit 251 is input to the CPU via the PI / O bus 202 and is subjected to complicated arithmetic processing such as a sequential automatic operation interlock and an operation end abnormality diagnosis circuit. To PI / O
It outputs to the basic logics 420 and 450 via the bus 202. The basic logic 450 outputs an operation command from the CPU after confirming the operation mode and the operation permission condition.

FIG. 12 is a mounting view of the system cabinet of the control device according to the present invention. Reference numeral 600 is a system cabinet, 601 is a digital controller, 602 is a controller input / output cable, 605 is an external terminal block, and 606 is an external cable. In this way, the digital controller input / output can be directly connected to an external process without the protection and manual operation circuit consisting of relays, etc., so it is possible to construct a very simple and highly reliable system. Become. Also, as shown in the figure, the DCM card is a printed circuit board that corresponds to each device in the process, and can perform maintenance such as replacement independently of other DCMs, so a highly autonomous control device can be used. It is possible to build.

[0045]

As described above, according to the present invention, in a plant control device for controlling a centralized control by a CPU for each equipment group of a plant, a DCM having an input / output function and a protection interlock function at the time of CPU failure is provided for each equipment in the group. Since it is provided, it is possible to construct a highly reliable system that prevents malfunctions and the spread of accidents. Further, since the protection function is realized by a simple structure mainly composed of a memory, there is an effect that the hardware structure can be made compact.

[Brief description of drawings]

FIG. 1 is a system configuration diagram showing an embodiment of the present invention.

FIG. 2 is a conventional system configuration diagram.

FIG. 3 is a diagram of a conventional manual circuit and a protection circuit using wired logic.

FIG. 4 is a cabinet mounting diagram of a conventional system.

FIG. 5 is an embodiment diagram showing a functional configuration of a CPU and a DCM of the present invention.

FIG. 6 is a block diagram of a protection logic unit in the DCM.

FIG. 7 is a detailed explanatory diagram of a protection logic unit.

FIG. 8 is a logic diagram illustrating an example of a logical configuration of protection logic.

FIG. 9 is a time chart logical diagram for explaining the operation of the protection logic.

FIG. 10 is a block diagram of a basic logic unit in the DCM.

FIG. 11 is a hardware configuration diagram of DCM.

FIG. 12 is a mounting view showing an example of a system cabinet of the present invention.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Digital controller, 8 ... Protection circuit, alarm circuit and manual operation circuit, 11a-11n ... Equipment, 153 ... D
CM (drive control module), 156 ... device group controller, 157 ... system controller,
252 ... Basic logic, 253 ... Protection logic, 403
… Protective logic memory.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Teruo Murao Inventor Teruo Murano, 2-3-1, Hitachi City, Ibaraki Prefecture Hitachi Engineering Co., Ltd. No. 1 within Hitachi Engineering Co., Ltd.

Claims (4)

[Claims] 1. A plant control device for controlling the operation of a plurality of equipments forming a plant or a predetermined part of the plant, which centrally calculates a control command signal necessary for each equipment to integrally control the plurality of equipments. A processing device (hereinafter, referred to as a CPU), a plurality of drive control modules (hereinafter, referred to as DCMs) provided independently between the CPU and the plurality of devices corresponding to the plurality of devices, respectively. A PI / O bus that forms a signal transmission path between the CPU and the plurality of DCMs is provided, and the DCM is an input / output unit that inputs a plurality of process signals of the corresponding device and outputs the control command signal. A protection means for outputting a protection operation signal to the device when a predetermined state signal indicating the abnormality of the corresponding device is received as the process signal. A plant control device characterized in that 2. The DCM is formed on a separate substrate,
The plant control device according to claim 1, wherein the plant control device is configured to be independently replaceable with another DCM. 3. The protection means, at an address position designated by a combination of an input section composed of an address bus and an input signal of the input section, a predetermined result representing a logical result according to the combination of the input signals. It has a storage unit for storing data in advance and an output unit composed of a data bus for outputting data at a designated address position, and a predetermined state signal indicating the abnormality is input to the input unit and a predetermined state is input between the input signals. The plant control device according to claim 1 or 2, wherein the protection operation signal is output to the output unit when the above combination is established. 4. The storage means stores the output procedure of a plurality of protection operation signals corresponding to each of the plurality of devices, and the storage means for selecting an output procedure corresponding to the DCM. 3. The plant control apparatus according to claim 1 or 2, further comprising an address designating means for setting the address of.