JPH10289001A - Control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain a control system which smoothly performs switching of a controller that is made redundant. SOLUTION: A side controller 8 is operated when a normal system controller 2A becomes abnormal and when the controller 2A is switched to a stand-by system controller 2B, and performs the correction control of a system state amount that is fluctuated with erroneous control of the controller 2A. And a main controller 3B is operated and starts the control of control objects after the system state amount is corrected to a normal control state with the correction control of the controller 8.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a control system having a redundant control device for controlling a control target constituted by a process system, a motor system, and the like.

[0002]

2. Description of the Related Art In general, among important control objects such as a process system and a motor system, important control objects are provided with redundant control devices, and even if a normal control device fails, it is switched to a standby control device. The control target can be controlled continuously. That is, when a failure occurs in the service control device of the service system, the control device is switched to the sound control device of the standby system, and the control target is continuously controlled.

FIG. 8 shows such a conventional control system 1.
FIG. Now, it is assumed that the control target 4 is controlled by the main control device 3A of the normal control device 2A. In this case, the switch 5 is on the main controller 3A side. In this state, the control target 4 is controlled by an operation signal from the main control device 3A of the service control device 2A, and the system state quantity C, which is the control amount of the plant 6, is input to the detector 7A. The detector 7A determines whether the system state quantity C has deviated from the limit value L,
The control result of main controller 3A is monitored.

In general, a microprocessor (microcomputer)
Is performed by a diagnostic circuit represented by a memory diagnostic function or the like built in the circuit, and switching to a standby control device is performed. Then, assuming that all abnormalities cannot be detected by this diagnosis, a large fluctuation of the system state quantity C resulting from the failure is detected by the detector 7A, and one of the abnormalities of the normal control device 2A is detected. And

Assuming that a failure has occurred in the main control device 3A, an erroneous operation signal is transmitted from the main control device 3A to the control target 4 immediately after the failure. Then, the control target 4 moves due to the erroneous operation signal, so that the system state quantity C, which is the control amount of the plant 6, fluctuates.

When the system state quantity C deviates from the limit value L, the detector 7A determines that an abnormality has occurred, and switches the control of the control to the standby controller 2B by switching the switching switch 5.
Switch to Thus, the main control device 3B of the control device 2B outputs an operation signal to the control target 4 via the switch 5 to control the control target 4. In this case, the system state quantity C, which is the control amount of the plant 6, is input to the detector 7B, and the control result of the main control device 3B is monitored by determining whether the system state quantity C has exceeded the limit value L. I do.

[0007]

However, in such a conventional control system, when the responsiveness of the controlled object 4 is fast, the system state quantity C of the controlled object 4 is switched between switching between the control devices 2A and 2B. Greatly fluctuates, and switching to the standby control device 2B may fail.

In the conventional control system 1, this is because the control device 2B, which has obtained the control initiative by switching, immediately after the switching, uses the detector 7B itself having the same limit value L as the detector 7A. This is because a change in the state quantity C is detected, and it is determined that its own control is malfunctioning.

FIG. 9 is a flowchart showing control contents in a conventional control system. If a failure occurs in the control device 2A during control by the control device 2A (S1) (S1).
2) The system state quantity C of the plant 6 fluctuates (S
3). The change in the system state quantity C is detected by the detector 7A (S4), the control device 2A stops the control, and the control device 2A
Switch to B (S5). In this case, since the control device 2B also detects the fluctuation of the system state quantity C by the detector 7B, (S
6), the control device 2B stops the control and stops the control of the plant 6 (S7). As described above, since the detector 7B detects the fluctuation of the system state quantity C, the control of the control device 2B is interrupted, and the function of the redundant configuration is not performed.

An object of the present invention is to provide a control system capable of smoothly switching between redundant control devices.

[0011]

A control system according to a first aspect of the present invention is provided in a standby system controller and operates when the control is switched from the service system controller to the standby system controller. A sub-control unit that performs correction control of the system state variable that fluctuates due to erroneous control by the control unit, and a control target that is provided in the standby control unit and operates after the system state variable is corrected to the normal control state by the correction control of the sub-control unit And a main controller for controlling the

[0012] In the control system according to the first aspect of the present invention, the sub-controller operates when the service control device becomes abnormal and control is switched from the service control device to the standby control device. Correction control of the system state quantity fluctuated due to erroneous control is performed. Then, the main control device operates after the system state quantity is corrected to the normal control state by the correction control of the sub control device, and starts the control of the control target.

[0013] The control system according to the second aspect of the present invention comprises:
In the invention of claim 1, in the correction control of the system state quantity by the sub-control device, when the control target is a regulating valve for regulating the feedwater flow rate in the reactor feedwater control, the regulating valve is closed, and the suction pressure is reduced. The stopped water supply pump is started, the regulating valve is opened to a certain opening, and when the water supply flow rate reaches a specified value, switching to the main control device in the standby system control device is executed.

[0014] In the control system according to the second aspect of the present invention, in addition to the operation of the first aspect of the invention, when the control object is a regulating valve for regulating the feedwater flow rate in the reactor feedwater control, the sub-control device is Perform the closing operation of the regulating valve, start the feed pump stopped by the low suction pressure, and perform the correction control of the system state quantity to open the regulating valve to a certain opening degree,
Thereafter, when the flow rate of the supplied water reaches a specified value, switching to the main control device in the standby system control device is executed.

According to a third aspect of the present invention, a control system comprises:
In the invention according to claim 1, in the correction control of the system state quantity by the sub-controller, when the control target is an inverter power supply in speed control of the rotating device, the output current of the inverter power supply is limited, and the output voltage is within a specified value. In this case, the phase of the inverter power supply is adjusted, the phase of the inverter power supply and the phase of the rotating device on the load side are matched, and switching to the main control device in the standby control device is executed.

In the control system according to a third aspect of the present invention, in the first aspect of the present invention, when the control object is an inverter power supply for controlling the speed of the rotating device, the sub-control device restricts the output current of the inverter power supply. Then, the output voltage is suppressed within the specified value, the phase of the inverter power supply is adjusted, and the system state quantity correction control is performed so that the phase of the inverter power supply matches the phase of the rotating device on the load side. After that, switching to the main control device in the standby system control device is executed.

According to a fourth aspect of the present invention, there is provided a control system comprising:
When all the control devices of the plurality of control devices connected via the communication network are normal, each control device executes a predetermined task, and one of the plurality of control devices malfunctions. Is a control system having a form in which another healthy control device takes over the task of the failed control device via the communication network and executes the task of the failed control device, and each control device has failed. A sub-control unit that operates when the task execution is taken over from the control device to another sound control device and performs a correction control of a system state quantity that fluctuates due to erroneous control by the control device that has become abnormal, and a correction of the sub-control device A main control unit that operates after the system state quantity is corrected to the normal control state by control and controls the control target.

In the control system according to a fourth aspect of the present invention, when all of the plurality of control devices connected via the communication network are normal, each control device executes a predetermined task. If an abnormality occurs in one of the plurality of control devices, another sound control device takes over and executes the task of the failed control device via the communication network. At that time, the sub-control means of each control device performs a correction control of the system state quantity that fluctuates due to erroneous control by the abnormal control device when the execution of the task is taken over from the abnormal control device, and When the system state quantity is corrected to the normal control state by the correction control, the main control unit starts controlling the control target.

According to a fifth aspect of the present invention, there is provided a control system comprising:
In the invention according to claim 4, the correction control of the system state quantity by the sub-control means performs a closing operation of the regulating valve when the control target is a regulating valve for regulating the feedwater flow rate in the reactor feedwater control, and performs the control by a low suction pressure. The stopped water supply pump is started, the regulating valve is opened to a certain opening, and when the water supply flow rate reaches a specified value, switching to the main control means in the standby system control device is executed.

In a control system according to a fifth aspect of the present invention, in addition to the operation of the fourth aspect, when the control object is a regulating valve for regulating a feed water flow rate in the reactor feed water control, the sub-control means comprises: The control valve is closed, the water supply pump stopped by the low suction pressure is started, and the correction of the system state quantity for opening the control valve to a certain opening degree is performed.
Then, when the flow rate of the supplied water reaches the specified value, switching to the main control means in the standby system control device is executed.

According to a sixth aspect of the present invention, there is provided a control system comprising:
In the invention according to claim 4, in the correction control of the system state quantity by the sub-control means, when an object to be controlled is an inverter power supply in speed control of the rotating device, the output current of the inverter power supply is limited, and the output voltage is within a specified value. The phase of the inverter power supply is adjusted, the phase of the inverter power supply and the phase of the rotating device on the load side are matched, and switching to the main control means in the standby control device is executed.

In the control system according to a sixth aspect of the present invention, in addition to the operation of the fourth aspect, when the control target is an inverter power supply for controlling the speed of the rotating device, the sub-control means outputs the output of the inverter power supply. Limit the current,
The output voltage is suppressed within a specified value, the phase of the inverter power supply is adjusted, and the correction control of the system state quantity for matching the phase of the inverter power supply with the phase of the rotating device on the load side is performed. Then, switching to the main control means in the standby control device is performed.

[0023]

Embodiments of the present invention will be described below. FIG. 1 is a configuration diagram showing a first embodiment of the present invention. The first embodiment is different from the conventional control system shown in FIG. 8 in that the standby system control device 2B operates when the control is switched from the service system control device 1A to the standby system control device, and the normal system is operated. A sub-control device 8 for performing a correction control of a system state quantity fluctuated by erroneous control by the system control device is provided, and a detector 7 for detecting an abnormality of the sub-control device 8 is provided.
C is additionally provided, and a switch 9 for switching between the main control device 3B and the sub control device 8 is further provided. Other configurations are the same as those of the conventional control system shown in FIG. 8, and therefore, the same components are denoted by the same reference characters and description thereof will be omitted.

In FIG. 1, the control device 2B of the standby system includes:
It is composed of a main control device 3B and a sub control device 8, and a switch 9 for switching from the sub control device 8 to the main control device 3B is provided. Further, a detector 7C for detecting an abnormality of the sub-control device 8 is provided, and the system state quantity C is set to the limit value L
When the value deviates from “a”, it is determined that the sub-control device 8 is abnormal.

The limit value La of the detector 7C for detecting an abnormality of the sub control device 8 is set to n times (n> 1) the limit value L of the detector 7B of the main control device 2B. That is,
The limit value La of the detector 7C of the sub control device 8 is
Is lessened than the limit value L. That is, even if the system state quantity C fluctuates greatly, it is not determined that the sub-control device 8 is abnormal unless it deviates from the limit value La (L * n).

Here, limit value L of detector 7B and detector 7
C is different from limit value La in main controller 2B.
Is intended to detect a change from a steady state to an abnormal state, whereas the detector 7C of the sub-controller 8 is intended to execute control for repairing a transient state of control switching. It is because it is.

The sub-control unit 8 restores and controls the system state quantity C generated immediately after taking over the control right. The sub-control unit 8 controls the system state quantity C to a specified range, and thereafter, the main control is performed by the changeover switch 9. The control is shifted to the control device 2B.

FIG. 2 is a configuration diagram when the control system 1 of the present invention is applied to water supply control of a nuclear reactor. In water supply control of the nuclear reactor, feed water is supplied under pressure from a water supply pump 10, adjusted by a regulating valve 11, and supplied to a nuclear reactor 12.
In this case, the water supply pump 10 and the regulating valve 11
And the reactor 12 is the plant 6.

The control system 1 of the present invention maintains the water level of the reactor 12 at a predetermined value by controlling the opening of the regulating valve 11. In a normal state, since the changeover switch 5 in the control system 1 is connected to the controller 2A of the service system, the opening of the regulating valve 11 is controlled by a control signal from the controller 2A.

The suction pressure of the feed water pump 10 is detected by a pressure gauge 13 and is input as a system state quantity C to each of the detectors 7A, 7B, 7C. A flow meter 14 is provided on the output side of the water supply pump 10, and the flow rate of the water supply is measured.

FIG. 3 is a flowchart showing the control contents in the control system 1 of the present invention. Now, it is assumed that control is being performed by the control device 2A (S1). If a failure occurs in the control device 2A in this state (S2), the suction pressure of the water supply pump 10, which is the system state quantity C of the plant 6, fluctuates (S3). The change in the system state quantity C is detected by the detector 7A (S4), and the control device 2A stops the control and switches to the control device 2B (S5). In this case, since the changeover switch 9 is on the sub-control device 8 side in the control device 2B, the sub-control device 8 is operated in the control device 2B to start the correction control (S8). Thereby, the system state quantity C in the plant 6 (the suction pressure of the feedwater pump 10)
The control is then switched to the main controller 3B (S9). By this control switching, main controller 3B starts control.

FIG. 4 is an explanatory diagram of the correction control performed by the sub-control device 8. That is, step S shown in FIG.
8, the specific contents of the sequence performed in S9 and S10 are shown. First, in step S8, the sub control device 8
Starts the control, first, the closing operation of the regulating valve 11 is performed. This is to prevent run-out of the water supply pump 10 when the water supply pump 10 is restarted because the water supply pump 10 is stopped to prevent cavitation caused by a decrease in suction pressure.

Next, the water supply pump 10 once stopped is started. This is because the water supply by the water supply pump 10 is continued. Then, the regulating valve 11 is gradually opened. This is to take the water supply load of the water supply pump 10 and bring it closer to the initial normal state.

In step S9, when the regulating valve 11 has a constant opening, the switch 9 is operated to operate the main controller 3B.
Switch to. Then, in step S10, control by main controller 3B is executed. As described above, the sub control device 8 performs the correction control for smoothly executing the switching to the main control device 3B.

FIG. 5 is a characteristic diagram showing a behavior at the time of control switching in the control system 1 of the present invention. Now, it is assumed that an abnormality has occurred in the control device 2A at the time t1, and the control device 2A has abnormally opened the regulating valve 11. When the control device 2A becomes abnormal at time t1, the regulating valve 11 becomes abnormally open, and the water supply pump 10
The flow rate flowing through the air rapidly increases. As a result, the pressure on the suction side of the water supply pump 10 decreases, and the water supply pump 10 automatically stops at time t2. This is to prevent cavitation caused by a decrease in pressure on the suction side.

Further, since the suction pressure of the water supply pump 10 is input to the detector 7A as the system state quantity C, when the detection device 7A detects that the suction pressure has deviated from the limit value L, the control device 2A starts the operation. , And enters control to transfer control authority to the control device 2B. Then, the control device 2B that has obtained the control right activates the sub-control device 8, and starts the correction control at time t3.

In the correction control by the sub-control unit 8, first, the closing operation of the adjusting valve 11 is performed, and the adjusting valve 11 is gradually closed, and then gradually opened. Then, at a time point t4, the water supply pump 10 that has been temporarily stopped is started, and water supply by the water supply pump 10 is started. Thereby, the water supply pump 10 takes the water supply load,
It approaches the initial normal state. Then, at time t5, switching to main controller 3B is performed.
To continue normal control.

As described above, according to the first embodiment, the controller 2A for the standby system and the controller 2B for the standby system are used.
When the control is switched to the sub-controller 8, the sub-controller 8 performs the switching after correcting and controlling the system state quantity C that has fluctuated by the control signal from the control device 2 </ b> A in which the abnormality has occurred. Can be.

Next, a second embodiment of the present invention will be described. FIG. 6 is an explanatory diagram of the correction control in the sub-control device 8 according to the second embodiment of the present invention. In the second embodiment, the control system of the present invention is applied to speed control of a rotating device having an inverter power supply.

In a redundant control device for controlling the speed of rotating equipment by variable frequency control using an inverter power supply device, if an abnormality occurs in the service control device 2A, the output current of the inverter suddenly increases due to, for example, control malfunction. To increase. Then, an electric charge is accumulated in the smoothing capacitor on the output side, resulting in an overvoltage. In this case, the control system 2A of the service system
Determines that the control device is abnormal, and transfers the control right to the standby control device 2B. At this time, the controller 2 of the standby system
When the transfer of the control right to B is executed, the state of the overvoltage continues, and the control device 2B of the standby system cannot continue the control.

Therefore, as in the case of the water supply control system of the nuclear reactor in the first embodiment, before starting the backup control, the correction control for suppressing the state of overcurrent and overvoltage to within an allowable range. I do.

FIG. 6 shows steps S8 and S8 shown in FIG. 3 when applied to speed control of a rotating device having an inverter power supply.
The specific contents of the sequence performed in S9 and S10 are shown. First, in step S8, when the sub-control device 8 starts the control, first, the output current of the inverter is limited and the voltage is released. This is to suppress the output voltage to a specified value. Then, an adjustment is performed so that the phase of the rotating device during free (rotation reduction) rotation matches the phase of the output of the inverter.

Next, in step S9, a phase match between the inverter and the rotating device (motor) is detected, and switching to the main controller 3B in the standby controller 2B is executed. Then, the inverter starts supplying power to the rotating device. In step S9, the main control device 3B assumes control authority, and thereafter, normal control is continued by the main control device 3B in the standby control device 2B. As described above, the sub control device 8 performs the correction control for smoothly executing the switching to the main control device 3B.

Next, a third embodiment of the present invention will be described. FIG. 7 is a configuration diagram showing a third embodiment of the present invention. In the third embodiment, the control system of the present invention is applied to a control system having a communication network.

As a control system having a communication network, there is a control system as shown in FIG. That is, the communication network 15 includes a plurality of control devices 2
A, 2B are connected, and all the control devices 2A, 2B
Is normal, each of the control devices 2A and 2B is executing a predetermined task. Then, when an abnormality occurs in one of the plurality of control devices 2A and 2B, the control device 2A in which the abnormality has occurred performs the task being executed by itself through the communication network 15 to another control device. It transmits to the healthy control device 2B. The other healthy control device 2B takes over and executes the task of the abnormal control device 2A.

In such a control system, digital technology is generally used, and a microcomputer is used as a device. The control algorithm is described in the microcomputer by a program. Therefore, the algorithm of the control process described below is programmed.

That is, each control device 2 has a control function of the control target 4 as a task. The control device 2A has a control function of the control target 4A as a task 1, and the control device 2B has a control function of the control target 4B as a task 2. And each control device 2
There is a sub-control unit that operates when the execution of the task is taken over from the failed control device to its own control device. This sub-control unit performs a correction control of the system state quantity C that has changed due to erroneous control by the control device that has become abnormal. Also, the main control means which operates after the system state quantity is corrected to the normal control state by the correction control of the sub control means,
This main control means controls a control target by processing a task.

Normally, the control device 2A controls the control target 4A in the plant 6 via the communication network 15.
Is controlling. Similarly, the control device 2B controls the control target 4B
Is controlling. When one of the control devices 2A fails, and the other healthy control device 2B performs backup control, the program of the task 1 in the failed control device 2A is transferred to another healthy control device via the communication network 15. To the appropriate control device 2B. The controller 2B executes the original task 2 and also executes the task 1 to continuously control the control target 1 in the plant 6.

In this case, the modification control is executed at an early stage of the processing of the task 1. That is, the correction control is executed by the sub-control means of the control device 2B. After that, the main control means of the control device 2B continuously executes the original control function of the task 1.

[0050]

As described above, according to the present invention, when a failure occurs in the control device, the control is continued after correcting the fluctuation of the system state quantity by the abnormal control device. As a result, it is possible to reliably switch to the control device on the healthy side of the redundant configuration, and to achieve stable control.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing a first embodiment of the present invention.

FIG. 2 is a configuration diagram when the control system of the present invention is applied to water supply control of a nuclear reactor.

FIG. 3 is a flowchart showing control contents in the control system of the present invention.

FIG. 4 is an explanatory diagram of correction control performed by a sub control device according to the first embodiment of the present invention.

FIG. 5 is a characteristic diagram showing a behavior at the time of control switching when the control system of the present invention is applied to water supply control of a nuclear reactor.

FIG. 6 is an explanatory diagram of correction control performed by a sub control device when the control system of the present invention is applied to speed control of a rotating device having an inverter power supply.

FIG. 7 is a configuration diagram when the control system of the present invention is applied to a control system having a communication network.

FIG. 8 is a configuration diagram of a conventional control system.

FIG. 9 is a flowchart showing control contents in a conventional control system.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 control system 2 control device 3 main control device 4 controlled object 5 switching switch 6 plant 7 detector 8 sub-control device 9 switching switch 10 feedwater pump 11 regulating valve 12 reactor 13 pressure gauge 14 flow meter

Claims (6)

[Claims] 1. A control device for controlling a control target constituted by a process system, a motor system, or the like is configured to be redundant, and the control target is normally controlled by a service control device when the service control device fails. In a control system that switches to a standby control device to control the control target,
A sub-control provided in the standby control device and operated when the control is switched from the service control device to the standby control device, and performs a correction control of a system state quantity changed by erroneous control by the service control device. A main control device that is provided in the standby control device and that operates after the system state quantity is corrected to the normal control state by the correction control of the sub-control device and controls the control target. Characteristic control system. 2. The correction control of a system state quantity by the sub-control device, wherein, when the control target is a regulating valve for regulating a feed water flow rate in a reactor feed water control, a closing operation of the regulating valve is performed, and the suction pressure is reduced. The start of the water supply pump stopped by the above, the regulating valve is opened to a certain opening, and when the water supply flow rate reaches a specified value, switching to the main control device in the standby system control device is performed. Claim 1
The control system according to item 1. 3. The correction control of a system state quantity by the sub-controller, when the control target is an inverter power supply in speed control of a rotating device, restricts an output current of the inverter power supply and sets an output voltage to a specified value. The phase of the inverter power supply is adjusted, the phase of the inverter power supply and the phase of the rotating device on the load side are matched, and switching to the main control device in the standby control device is performed. The control system according to claim 1, wherein: 4. When all control devices of a plurality of control devices connected via a communication network are normal, each control device executes a predetermined task, and among the plurality of control devices, When an abnormality occurs in a certain control device, in a control system having a form in which another healthy control device takes over the task of the abnormal control device via a communication network and executes the task, A sub-control unit that operates when the execution of a task is taken over from the failed control device to another healthy control device and performs correction control of a system state quantity that fluctuates due to erroneous control by the failed control device; A main control unit that operates after the system state quantity is corrected to the normal control state by the correction control of the sub control unit and controls the control target. system. 5. The correction control of a system state quantity by the sub-control means, when the control target is a regulating valve for regulating a feed water flow rate in a reactor feed water control, performs a closing operation of the regulating valve to reduce a suction pressure. The water supply pump which has been stopped is started up, the regulating valve is opened to a certain opening, and when the water supply flow rate reaches a specified value, switching to the main control means in the standby system control device is performed. Claim 4
The control system according to item 1. 6. The correction control of a system state quantity by the sub-control means, when the control target is an inverter power supply for speed control of a rotating device, restricts an output current of the inverter power supply and sets an output voltage to a specified value. The phase of the inverter power supply is adjusted, the phase of the inverter power supply and the phase of the rotating device on the load side are matched, and switching to the main control means in the standby control device is performed. The control system according to claim 4, wherein: