JPS6123204A - Controller - Google Patents

Abstract

PURPOSE:To attain the reliability equivalent to that of a controller of triple structure by deciding a fault in case the deviation is large between the estimated feedback signal and the actual signal when the deviation between the arithmetic results of both controllers of double structures exceeds the allowance value. CONSTITUTION:A fault deciding part 31 feeds the arithmetic results 14a and 14b of an A-system and B-system control arithmetic parts 11a and 11b respectively. A deviation monitor 32 always works and decides a fault if the deviation exceeds an allowance level. While a simple model 34 of a control system is used to obtain the estimated value 35 equivalent to a feedback signal 4 from the target value 3. A deviation monitor 36 always monitors both the value 35 and the real feedback signal 4 and decides a fault in case the time during which the deviation exceeds an allowance level. Furthermore two fault detecting functions are combined to decide a fault of a system under a control mode or a system under a waiting mode.

Description

[Detailed Description of the Invention] [Field of Application of the Invention] The present invention relates to a control device having a duplex configuration, and in particular to a control device having a duplex system suitable for realizing high reliability of an atomic bomb reservoir. Regarding.

[Background of the invention]

FIG. 6 shows a schematic block diagram of a conventional control device 1 having a duplex configuration. Command signal (target value) 3 from the host control system, etc.
is a duplicated control calculation unit 11a.

11b (hereinafter referred to as A system and B system, respectively).

On the other hand, the feedback signal 4 from the controlled object 2 is also input to each control calculation unit 11a, 11H, and in order to make the deviation 12a, 12b from the command value 3 zero, the control calculation function 13a,
13b operates to output respective control output signals 14a and 14b. One of these control output signals 11a and 14b is selected by the signal selection section 21, and the final control signal 1
6 is given to the controlled object 2.

There are various conventional methods for configuring the signal selection section 21, but the main methods are 1) Systematically selecting one from two signals (14a, 14b) in seven directions.

Specifically, there is a method of selecting a high value or a method of selecting a low value.

2) Diagnose an abnormality in the control calculation units 11a9, llb, etc., and at least avoid selecting signals on the side where an abnormality has been detected (Fig. 2).

It can be classified into two types. The former is a fail-safe operation from a system perspective, but depending on the system, it may not necessarily be 7
Since the fail-safe direction is not determined or the fail-safe direction is fixed, the operation rate of the control system will be reduced, so its application is extremely limited. On the other hand, the latter has been increasingly used recently because by using a computer in the control calculation section, the ability to diagnose abnormalities can be generally enhanced without adding any special hardware. An example of the logic is shown in FIGS. 6 and 7(a). FIG. 7(b) is a chart for explaining the symbols used in FIG. 7(a).

The self-diagnosis result 15a of the A-system control calculation section and the self-diagnosis result 15b of the B-system control calculation section are input to the selection logic section 22 of the signal selection section 21.

1) When both the A system and the B system are determined to be normal, the A system is automatically selected, and the A thread signal selection relay contact 24a is turned on by the A system selection command 23a. At this time, the B yarn signal selection relay contact 24b remains in the off state.

If you want to switch to B system control for some reason,
By turning on the B system manual selection switch, 24a
Off, 24. b changes to on. If you want to switch to A-system control again, you can similarly turn on the A-system manual selection switch.

2) If an abnormality is detected in the A system while the A system is being controlled (selected) or the B system is on standby, control immediately shifts to the B system. That is, from the state of 24a on, 24b off, 24a off, 2
Change to 4b on.

3) If an abnormality is detected in the KB system while the A system is on standby while the B system is being controlled (selected), control immediately shifts to the A system. That is, from the state of 24a off and 24b on, the state of 24a on and 24
b Changes to off.

4) Even if an abnormality is discovered in the control calculation unit on the standby side, the control itself will not change.

5) Note that if both systems A and B become abnormal, a 7-factor action such as locking the operating end or a fail-safe action is often taken.

6) Also, although this logic does not show issuing a warning upon detecting an abnormality, it is a method that is often used in practice.

Although this logic is extremely effective in terms of aS and can be expected to be considerably more reliable than a single-layer system, 1) the basic operation is a single-layer system with a backup system. The reliability of the output signal itself is
It is equivalent to a single-layer system.

2) The system reliability (
(operating rate) will change significantly.

3) Even if the calculation results of system A and B do not match, if the self-diagnosis function cannot detect an error, it cannot be determined which data is correct, and therefore, in the worst case, abnormal control is allowed. You may end up doing this.

For these reasons, there are many problems in applying it to systems that require ultra-high reliability. Therefore, in general, a triplex system capable of majority decision making is used as a control device for systems that require ultra-high reliability, but this requires an enormous amount of hardware and is also expensive. Therefore, the scope of application must be limited to some extent.

[Purpose of the invention]

The purpose of the present invention is to basically have a dual configuration, but to
It is an object of the present invention to provide a control device having a system configuration that achieves high reliability comparable to that of a heavy duty system.

[Summary of the invention]

In order to achieve the above object, a control device having a duplex configuration according to the present invention compares the calculation results of each control calculation unit, and detects an abnormality as a deviation hole when the deviation exceeds a tolerance value. a means for estimating a feedback signal from a controlled object, and a feedback equivalent signal estimated by the means for estimating the feedback signal and an actual feedback signal, and the deviation thereof exceeds a tolerance value. means for detecting an abnormality as a deviation hole when a deviation occurs; means for determining an abnormality occurrence side by combining the states detected by the various means; and receiving determination results from the means for determining the abnormality occurrence side; The gist of the present invention is to include a means for switching between seven overlapping stems. In short, the present invention is
1. In a duplex system, the abnormality detection ability is inferior to a triple system. Focusing on the fact that there is a limit to achieving ultra-high reliability, we added an anomaly determination function that is simple and can dramatically increase anomaly detection capabilities. This system takes advantage of the following advantages (small amount of data and low price) and achieves ultra-high reliability comparable to that of a triplex system.

In an advantageous embodiment of the present invention, the feedback signal detector is also 2N, and each detection signal is duplicated and input as a feedback signal to the control calculation section, and the duplicated feedback signal is means for comparing the values and detecting an abnormality as a deviation hole when the deviation exceeds an allowable value; means for determining the location where the abnormality has occurred by combining the states detected by the abnormality detecting means; Means is provided for taking in the determination result from the means for determining the location, switching the duplex system, and always selecting the normal side.

Hereinafter, the present invention will be explained in more detail using examples with reference to the drawings, but these are merely illustrative and it is understood that various modifications and improvements may be made without going beyond the scope of the present invention. Of course.

[Embodiments of the invention]

FIGS. 1 and 2 show the configuration of a control device when the present invention is applied to the duplex system shown in FIGS. 6 and 7. In other words, the abnormality determining section 31 is added to the device shown in Figure i.

The functions of the abnormality determination section 310 will be explained below. Abnormal row constant part 3
The first function of 1 is to input the calculation results 14a, 14 bits of the A system control calculation section and the B system control calculation section, and constantly monitor this deviation with the deviation monitor 32. If a deviation greater than the allowable deviation occurs and this continues for more than a specified time, it is determined that the control calculation results do not match.

The TDPU 33 in Figure i1 is a time delay pickup element (time limit element). Abnormality determination section 31
The second function of is to take advantage of the fact that when the control system is operating normally, the feedback signal 4 follows the command value (target value) 3 in a certain relationship. If the correlation between the feedback values 4 and 4 deviates, it is determined that there is an abnormality in the control system. That is, using the simple model 34 of the control system, from the command value (target value) 3,
An estimated value 35 corresponding to the feedback signal 4 is obtained, and this is constantly monitored by the deviation monitor 36 between this and the actual feedback signal 4. If a deviation greater than a preset tolerance occurs between the two signals, this will occur within the specified time. If this continues, it is determined that there is an abnormality on the control side. The third function of the abnormality determination unit 31 is the function of Uemachi voice 1, the mismatch detected by the second function,
By combining abnormalities, it is determined whether the abnormality is in the system currently under control or in the standby system. In the first function, 2
The system detects that an abnormality has occurred in either the heavy system, uses the second function to determine whether the abnormality is on the control side or the standby side, and makes a final judgment based on these two conditions. This enables reliable detection of abnormalities. Furthermore, in this method, deviation monitors 32, 36, TDPU 33
．． 37 and the control system model 34 do not require very detailed testing or analysis, which can also be cited as a great practical advantage. For example, with only the first function, it can be determined whether an abnormality has occurred in one of the dual systems, but it is difficult to know more than that. Also, with only the second function, the accuracy of the control system becomes a problem.
Increasing the reliability of anomaly detection requires extremely complex modeling. Also, if an unexpected disturbance were to occur in the system, there is a possibility that an abnormality would be detected, but with the method of the present invention, the model is only used when an abnormality occurs in one of the dual systems. The judgment result using . Therefore, in general, a model that is a combination of dead time elements and second-order delay elements is sufficient, and the possibility of false detection of an abnormality even though it is not abnormal is extremely small (depending on the target system, this model may also be deleted). It is possible, and of course there are many cases where the first-order lag element alone is sufficient for practical use.)

Control-side abnormality signal 38 which is the determination result of the main abnormality determination unit 31
Alternatively, the standby side abnormality signal 39 is input to the selection logic section 22 of the signal selection section 21 .

FIG. 2 shows a specific example of the selection logic of the selection logic section 22. By combining the conditions of whether the current control is being performed by the A system or the B system and the conditions of the control side abnormality signal 38 and the standby side abnormality signal 39, it is possible to determine whether the abnormality is in the A system or the B system. It is determined whether there is an abnormality. Note that when the control system is switched due to an abnormality, the system that has become the new control side operates to return to the normal state, but it may not return to normal immediately, so TD
PUs 25a and 25b are provided to ensure stability immediately after switching. In addition, automatic switching logic based on self-diagnosis is the seventh
It is equipped in the same way as shown in the figure.

According to the configuration described above, it is possible to determine in which system an abnormality has occurred, which is said to be impossible when a discrepancy occurs between dual systems. By adding a simple diagnostic circuit, a dual-system system can have similar abnormality detection capabilities. Therefore, the normal 2
Significant improvements in reliability can be achieved compared to heavy systems.

FIG. 3 shows an example of application of the present invention in a duplex system in which the feedback signal is also duplicated.

In general, in feedback control, the loss of a feedback signal can lead to runaway control, so the feedback signal detector is often duplicated as shown in this figure. In the duplex system shown in Fig. 1, the data input to the two control calculation units is the same data, but in the system shown in Fig. 3, the consistency of the input data is not necessarily guaranteed. Although a slightly more complicated judgment logic is required, the basic idea is almost the same.

The functions of the abnormality determination section 31 can be broadly divided into three parts, as in the example shown in FIG.

1) Control calculation result mismatch detection function 2) Feedback signal, control system abnormality detection function 3) Abnormality determination function 1) is exactly the same as the example in Figure 1, but 2) has two feedback signals, so this The problem is to detect an abnormality in the feedback signals 4a and 4b and an abnormality on the control side or standby side by checking the deviation between the three signals obtained by adding the feedback signal equivalent estimated value 35 to the feedback signal equivalent estimated value 35. 3)
A final judgment is made based on a combination of these detected abnormalities.

Now, as shown in FIG. 3, the calculation data 1 of the control calculation section
The deviation check results of 4a and 14b are converted into an abnormality detection signal a (4
4) and duplicated feedback signals 4a and 4b
The deviation check result between the B system feedback signal 4b and the feedback signal estimated value 35 is the abnormal signal c (46), and the deviation check result between the
The deviation check result between the system layer feedback signal 4a and the feedback signal estimated value 35 is used as an abnormality detection signal d (47).
If we consider the combination as 1 when an abnormality is detected and 0 when no abnormality is detected, the result will be as shown in FIG. The meaning of each case will be explained below.

1) Case 1 All of the abnormality detection signals a, b, c, and d are 01, that is, no abnormality has been detected, and it is determined to be normal.

2) Case 2 The difference between feedback signals 4a and 4b and the deviation between feedback signal 4a and estimated value 35 are normal, but this is an extremely rare case where the deviation between feedback signal 4a and estimated value 35 is detected as abnormal, and the system This is a case that can be considered normal.

3) Case 3 Same as case 2 (but 4a and 4b are swapped).

) 4) Case 4 A case in which the deviations of the feedback signals 4a and 4b are normal, but the deviations between the estimated values 35 and 4a and 4b are detected as abnormal.

A case where it can be assumed that the estimated value 35 is an estimation error, the characteristics of the controlled object have changed (an abnormality has occurred), or some kind of disturbance has been added to the system.

Since both the two feedback signals and the two control calculation units can be considered normal (because the deviation is normal), it may be determined that the overall operation is normal. It may be better to do 7-hour as-is movements).

5) Case 5 This is an extremely unlikely case in which the deviation between the feedback signals 4a and 4b is abnormal, but the estimated values 35 and 48, 35' and 4b are normal.

Although this case may appear at an early stage when an abnormality has just occurred in one of the feedback signal detectors, it is thought that the case will eventually shift to case 6 or case 7. Therefore, this case can be judged to be normal for the time being.

6) Case 6 Feedback signals 4a and 4b, 4a and 35 are abnormal,
Since 4b and 35 are normal, the feedback signal 4a
A case where it can be judged as abnormal. It is thought that the situation will eventually move to Case 14. Since the A system performs control calculations based on the abnormal feedback signal, control must be transferred to the B system.

7) Case 7 This corresponds to Case 6, where the A and B systems are reversed. Must be controlled on the A system side.

-8) Case 8 Either the estimation accuracy of the feedback signal estimate value 35 is poor, or both the feedback and signal detectors are abnormal, and the control calculation result data calculated using the feedback signal with a large deviation has a deviation. This is an extremely unlikely case. If we were forced to do something, it would probably be to lock the operating end, but since it is thought that the situation will eventually shift to case 16, it is not necessarily necessary to take any corresponding action.

9) Case 9 A case where the control calculation results have a large deviation, but the system is considered normal. In other words, the control side is operating correctly,
It can be assumed that an abnormality has occurred in the control calculation unit on the standby side.

10) Case 10 This is a case in which a large deviation is also detected in the control calculation results in Case 2, and the abnormal location cannot be determined.

However, since it is thought that the situation will eventually move to Case 9 or Case 12, there is no need to take any immediate action, even considering the low possibility that this case will occur.

11) Case 11 In Case 10, the A system and B system are swapped.

12) Case 12 Both feedback signals can be considered to be true values. Since this is significantly different from the estimated value and the deviation of the control calculation result is large, it is considered that the system is being controlled by the output of the control calculation section where the abnormality has occurred. Therefore, it is necessary to switch to the standby side.

13) Case 13 Similar to case 5, this is an extremely unlikely case. Since the estimated feedback signal values match well with the measured values, the system is considered to be operating normally, so no special measures are required.

14) Case 14 A case in which the feedback signal of the A system became abnormal, and the control calculation data calculated using this data differed greatly from the data of other systems.

Control must be transferred to the B system.

15) Case 15 Case 140A and B series are reversed. A system control is appropriate.

16) Case 16 This is considered to be a case in which the situation in Case 8 has evolved. The operating end must be locked.

Based on the above considerations, cases 6, 7, 9, 12 and 14.15 have some kind of abnormality related to switching, and case 16 requires locking of the operating end. Yes (Case 4, 5, 8, 10, 11
．． 13 may also be an operating end lock. This must be determined based on the characteristics of the target system. )
.

FIG. 5 summarizes and shows the switching logic of this system.

In this redundant system, even if a failure occurs within the scale of the control system excluding the controlled object, it is possible to continue control by detecting it and switching over.

The above explanation has been made for the control loop, but for large-scale digital control systems (multivariable control), the most important Even if this method is applied only to important control loops, the effect basically remains the same.

In other words, the normality of the operation within the central processing unit is determined based on one point of representative data, but the present invention is only meaningful even though both systems are normal in self-diagnosis. First, the output data is inconsistent,
This is because there are actually almost no cases in which only one piece of data out of a large number of pieces of data computed by the same computing device becomes abnormal.

Furthermore, in the embodiments described above, the self-diagnosis results are also incorporated into the switching logic to make a comprehensive judgment, but when the control calculation section is configured with an analog calculation unit, this It is not always possible to add diagnostic functions. In this case as well, the switching logic may be constructed by deleting this self-diagnosis result.

〔Effect of the invention〕

As explained above, according to the present invention, it is possible to provide a dual system with the same level of abnormality detection ability as a triple system. It is possible to achieve similar values.

Furthermore, the additional circuitry required for the above is extremely simple.

In general, if the amount of hardware in a single system is 1, it will increase to about 2.5 for a double system, and about 4.5 for a triple system, and if the system reliability is also 1 for a single system, it will be about 10 for a double system. .It rises to about 100 for triple systems (however, it depends on the system scale).
. According to the present invention, it is possible to achieve reliability close to that of a triplex system without substantially increasing the amount of hardware compared to a dualx system, thereby providing a highly reliable system with excellent cost performance.

[Brief explanation of the drawing]

FIG. 1 is a configuration diagram of a control device according to a first embodiment of the present invention, FIG. 2 is a switching logic diagram in the device shown in FIG. 1, and FIG. 3 is a control diagram according to a second embodiment of the present invention. FIG. 4 is an explanatory diagram showing the switching logic in the device shown in FIG. 3, and FIG. 5 is a diagram of the switching circuit in the device shown in FIG. 3. 1... Redundant control device, 2... Controlled object, 3...
Command signal (target value), 4... Feedback signal, 4
a... Feedback signal A system, 4b... Feedback signal B system, 5a... Feedback signal detector A system, 5b... Feedback signal detector B system, 11
a... Control computing unit A system, 11b... Control computing unit B system, 12a... Control deviation signal A system, 12b... Control deviation signal B system, 13a... Control computing function A system, 13b・
...Control calculation function B system, 14a...Control output signal A system, 14b...Control output signal B system, 15a...Self-diagnosis result A system, 15b...Self-diagnosis result B system, 16.・
- Control signal, 21... Signal selection section, 22... Signal selection logic section, 23a... A system selection command, 23b...
・B system selection command, 24a...A thread signal selection relay, 2
4b...B thread signal selection relay, 25a, 25b...
Time-limited element (time delay pickup), 31...
Abnormality determination unit, 32... A system/B system control output signal deviation detection monitor, 33. 37, 41. 43... Time-limited element (time delay pickup), 34... Simple operation model of control system, 35 ...Feedback signal estimated value, 36.42...Difference detection monitor between actual feedback signal and estimated value, 38...Control side abnormality determination signal, 39
...Standby side abnormality determination signal, 40...A system/B system feedback signal deviation detection monitor, 44...A system/B system control output signal deviation large signal, 45...A system/B system feedback Signal deviation large signal, 46...B system feedback signal/feedback signal estimate value deviation large signal, 47
...A system feedback signal/large deviation signal of feedback signal estimated value.

Claims (1)

[Claims] 1. In a control device having a duplex configuration, means for comparing the calculation results of each control calculation unit and detecting an abnormality as a large deviation when the deviation exceeds an allowable value; A means for estimating a feedback signal from a controlled object, and a feedback equivalent signal estimated by the means for estimating the feedback signal and an actual feedback signal are compared, and if the deviation exceeds a tolerance value, the deviation is determined to be large and abnormal. a means for determining the side where an abnormality has occurred by combining the states detected by the above-mentioned means; and a means for taking in the determination result from the means for determining the side where the abnormality has occurred;
1. A control device comprising: means for switching a duplex system. 2. The feedback signal detector is also duplicated, and each detection signal is input as a feedback signal to the duplicated control calculation unit, and the duplicated feedback signals are compared and the deviation is determined as permissible. A means for detecting an abnormality as a large deviation when the value exceeds a value, a means for determining the location of the abnormality by combining the states detected by the above-mentioned means for detecting the abnormality, and a determination result from the means for determining the location of the abnormality. 2. The control device according to claim 1, further comprising means for taking in the duplex system, switching the duplex system, and always selecting the normal side.