JPS6136803A - Process controller - Google Patents

Abstract

PURPOSE:To improve the reliability of a process controller by constituting a selection circuit for output of a multiplexed controller with a majority circuit and a diagnosis circuit for said majority circuit and switching the majority circuit when the diagnosis circuit detects a fault. CONSTITUTION:The signals selected by the intermediate value selecting circuits 5A and 5B among output signals S1A-S1C of controllers 2A-2C are delivered to a process 1 to be controlled as an output signal S2 of a process controller 4. The outputs of circuits 5A and 5B are monitored by diagnosis circuits 6A and 6B for detection of faults. When a fault of the circuit 5A is detected by the circuit 6A of a selection circuit 3 set at the using side, the output S4A of the circuit 6A is equal to ''1'' and energizes a relay 7. Therefore the contacts 7B and 7A of the relay 7 are turned off and on respectively. Thus the circuit 3A is switched to a selection circuit 3B set at the waiting side. Then an output signal S3B of the circuit 5B put under a waiting mode is used as the output signal S2 of the controller 4.

Description

TECHNICAL FIELD OF THE INVENTION The present invention relates to multiplexed process control devices for controlling process conditions.

[Technical background of the invention and its problems] In recent years, in process control devices that require high reliability, multiplexing configurations such as duplication and triplexing are adopted to improve the reliability of the control device. It's becoming more common.

To multiplex a process control device, there are two methods: to have a regular controller and a standby controller, and switch to the standby controller in the event of a failure of the regular controller, and to operate multiple controllers at all times. A method is known in which the output of a controller is selected by majority vote and output.

In the former method, a failure detection circuit that determines whether the controller is normal or abnormal is essential, but determining whether the controller is normal or abnormal is complicated and difficult. In addition, switching from the regular controller to the standby side is performed when the failure detection circuit determines that there is an abnormality, so if a failure that cannot be detected by the failure detection circuit occurs, the switching operation will not be performed and the The output to is abnormal. Furthermore, as the failure detection ability of the failure detection circuit increases, the failure detection circuit itself becomes more complex, and failures of the failure detection circuit itself become a problem.

On the other hand, the latter method requires at least three controllers because the output is selected by majority vote.
Also, there is no need for a failure detection circuit to determine whether the controller is normal or abnormal. When the majority circuit has three controllers,
If the output of the controller is an analog quantity, it can be easily configured with an intermediate value selection circuit, and if the output of the controller is a binary digital quantity, it can be easily configured with a 2 out of 3 logic circuit. At this time, it goes without saying that even if one controller fails, the output of the process control device is maintained normally.

For this reason, control devices using the latter method are often used to control processes that require particularly high reliability, such as nuclear power plants.5 Figure 5 shows a conceptual diagram of a triplexed process control device. It is something that In FIG. 5, the process 1 to be controlled includes output signals S from three controllers 2A, 2B, and 2C.
Among sA, SIB, and SIC, the value selected by the selection circuit 3 is outputted as the output signal S2 of the process control device 4. In the case of triple controllers, the selection circuit 3 is composed of an intermediate selection circuit or a 2 out of 3 logic circuit.
Hereinafter, we will discuss a triplexed process control device with the selection circuit 3 as an intermediate value selection circuit. Of course, it goes without saying that the same thing applies to triple or more process control devices.

In the triplex process control device 4, controllers 2A, 2B, 2
Even if any one of the process control devices C fails, the process control device 4
Since the output signal S2 of the controllers 2A, 2B, and 2C is normal, the functions of the controllers can be maintained without interruption.
Higher reliability can be achieved than in the case of one unit. However, 3
The intermediate value selection circuit 3 provided for the purpose of keeping the output of the process control device 4 normal even if one of the multiple controllers 2A, 2B, and 2C breaks down is a single intermediate value selection circuit 3. Therefore, if the reliability of the intermediate value selection circuit 3 is not sufficient, not only will there be no point in multiplexing the controllers, but the intermediate value selection circuit 3
Therefore, a problem arises that reduces the reliability of the process control device 4 as a whole.

[Object of the Invention] An object of the present invention is to provide a highly reliable process control device that can solve the above problems and always provide a normal output to a process.

[Summary of the Invention] For this reason, the present invention adds a diagnostic circuit to the majority circuit to detect a failure by monitoring the signal of the majority circuit that selects the output of a multiplexed controller, and detects a failure in the majority circuit. In addition, this majority circuit is multiplexed and an output switching circuit is provided so that a normal majority circuit is always selected as the output of the process control device based on the output of the diagnostic circuit, thereby increasing the reliability of the process control device as a whole. It is characterized by being designed to increase the

[Embodiments of the invention] Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows a configuration diagram of a process control device according to an embodiment of the present invention. In the figure, the same reference numerals as in FIG. 5 indicate the same or corresponding parts, and the difference from the conventional configuration in FIG. 5 is that the selection circuit is duplicated and is 3A.

3B, and the selection circuits 3A and 3B are configured with intermediate value selection circuits 5A and 5B, and diagnostic circuits 6A and 6B that check whether they are normal or abnormal, and furthermore, the intermediate value selection circuits 5A and 3B are A switching circuit consisting of a relay 7 and its contacts 7A and 7B for switching the outputs S3A and 33B of the 5B is provided, and an indicator 8 is provided which is energized by the diagnostic circuit 6B.

With this configuration, the process 1 to be controlled receives the output signals SIA, SI of the three controllers 2A, 2B, and 2C.
The signal selected by the intermediate value selection circuits 5A and 5B among B and SIC is outputted as the output signal S2 of the process control device 4. Here, intermediate value selection circuits 5A and 5B
is the diagnostic circuit 6A.

6B monitors the output and detects its failure.

If the selection circuit 3A on the user side is operating normally,
No failure is detected in the diagnostic circuit 6A, and the diagnostic circuit 6A
The output S4A becomes sr Orr, and the relay 7 becomes de-energized. Therefore, contact 7B of relay 7 is ON and contact 7A is ON.
is OFF, the output signal S of the intermediate value selection circuit 5A
3A is a process controller! 4 output signal S2 is obtained.

Next, by the diagnostic circuit 6A of the selection circuit 3^ on the user side,
When a failure of the intermediate value selection circuit 5A is detected, the output S4A of the diagnostic circuit 6A becomes "1"" and energizes the relay 7. When the relay 7 is energized, the contact 7B of the relay 7 becomes 0.
Since FF and contact 7A are turned on, the selection circuit 3 on the standby side
The switching to B is performed, and the intermediate value selection circuit 5B on the standby side
The output signal SsB of the process control device i4 is the output signal SsB of the process control device i4.
It becomes 2.

In this way, even if the intermediate value selection circuit 5A on the use side fails, the first diagnostic circuit 6A detects the failure, switches to the intermediate value selection circuit 5B on the standby side, and makes the output signal S2 of the process control device 4 normal. can be kept.

Furthermore, even if the diagnostic circuit 6B detects a failure in the intermediate value selection circuit 5B on the standby side, if the intermediate value selection circuit 5A on the use side is normal, the output signal S2 of the process control device 4 will remain normal. be able to.

In this case, by displaying on the display 8 that the intermediate value selection circuit 5B has failed using the output signal 54B of the 1 diagnostic circuit 6B, it is possible to recognize the failure of the intermediate value selection circuit 5B on the standby side.

FIG. 2 shows a conceptual diagram of an embodiment of the selection circuit 3A comprising the intermediate value selection circuit 5A and the diagnostic circuit 6A. As shown in the figure, the intermediate value selection circuit 5A of this embodiment receives the multiplexed controller output signal S+A.

Low value selection circuits 9A and 9B that receive SIB and SIC
, 9C and their output signals Ss A, 55 B, 55
and a high value selection circuit 10A that receives C. On the other hand, the 1 diagnostic circuit 6A uses the outputs Ss A, S5 a of the low value selection circuits 9A, 9B, and 9C that constitute the intermediate value selection circuit 5A.
, Ss c and the output S3A of the high value selection circuit 10A, it is determined whether the intermediate value selection circuit 5A is normal or abnormal, and if a failure is detected, the diagnostic circuit output signal S4A is set to 1111+ to excite the relay 7.

The diagnosis circuit 6A determines whether the intermediate value selection circuit 5A is normal or abnormal by comparing the values of the low value selection circuit output signal 55AI55BISsc and the high value selection circuit signal S3A, that is, the low value selection circuit output signal SsA. , 55 B
, 55C are different values, it is assumed that one of the low value selection circuits 9A, 9B, and 9C is malfunctioning. In addition, the low value selection circuit output signal Ss Al5
6 If any two values among B and S5C are equal,
If the value of the remaining one low value selection circuit output signal differs from the value of the high value selection circuit output signal 53A, it is assumed that the high value selection circuit 10A has failed.

When a failure is detected in the diagnostic circuit 6A through the above diagnosis, the relay 7 is energized to disconnect the output S3A of the intermediate value selection circuit 5A and switch to the output 53B of another normal intermediate value selection circuit 5B.

FIG. 3 shows an example of the diagnostic circuit 6A. As shown in the figure, the diagnostic circuit 6^ outputs the low value selection circuit output signal Ss Al35
2 of B, 55 C and high value selection circuit output signal S3A
an inverter element 12 that inverts the output of the comparator circuit 11; and an AN that receives the inverter element 12 or the output of the comparator circuit 11 as an input.
D elements 13A to 13D and AND elements 13A to 13D
It is composed of an OR element 14 which receives all the outputs of . Here, the comparator circuit 11 outputs 11011 if the values of the two signals are equal, and outputs 111 It if the values are different. The output of the comparator circuit 11 is output as is or is inverted by the inverter element 12, and then output to AND elements 13A to 1.
3D input, and AND elements 13A-13D determine whether the low value selection circuit output signals S5A, S5B, S5C and the high value selection circuit output signal S3A are normal or abnormal.

That is, in the AND element 13A, the low value selection circuit output signal Ss
Since all comparison combinations of two signals among Al55 B and S5 c are input, if the values of the low value selection circuit output signals Ss Al55 B and 55 C are all different, the output of the AND element 13A is 171 H. Therefore, a failure of the low value selection circuit can be detected. Also, AND element 13
In B, when the values of the low value selection circuit output signals S5A and 55B are equal, if the high value selection circuit output signal S3A is normal, it will be equal to the low value selection circuit output signal Ssc, but if it is not equal to 1, the output of the AND element 13B is 111H, and a failure of the high value selection circuit can be detected. Do the same.

The AND element 13C outputs the low value selection circuit output signal SsB.

When the values of Ssc are equal, the AND element 130 can detect a failure of the high value selection circuit when the values of the low value selection circuit output signals Ssc and SsA are equal.

The outputs of the AND elements 13A to 13D are input to the OR element 14, and if any one of the AND elements 13A to 130 detects a failure, the diagnostic circuit output signal becomes 1''.

As described above, the selection circuit 3A is configured by adding the diagnostic circuit 6A for detecting a failure to the intermediate value selection circuit 5A, and monitors the output of the intermediate value selection circuit 5A. By switching to another multiplexed selection circuit 3B, a normal control signal can always be transmitted to the process. In addition, the average repair time (
Since the mean time to failure (MTTR) is sufficiently small compared to the mean time to failure (MTBF), there is no need to consider simultaneous failures of the intermediate value selection circuits, and the structure of the part of the relay that switches the intermediate value selection circuits is simple. Since the reliability can be made very high, the reliability of the process control device can be increased in a very small way.

In the above embodiment, the case where the selection circuit 3 is duplicated is explained, but for example, as shown in FIG. By adding a switching circuit consisting of 15A and 15B, a triplex configuration can be achieved. It goes without saying that a multiplexed configuration such as a quadruplex configuration can be similarly adopted.

Further, in the above embodiment, an example was shown in which the switching circuit was configured using a relay, but it is of course possible to configure the switching circuit using a semiconductor element such as an FET and a circuit.

Furthermore, in the above embodiment, two intermediate value selection circuits are configured with three low value selection circuits and one high value selection circuit. It goes without saying that even if the intermediate value selection circuit is configured with a low value selection circuit of , the same effects as those of the above embodiment can be obtained.

Further, in the above embodiment, an intermediate value selection circuit is used as an example of the majority circuit, but it goes without saying that a majority logic circuit may also be used in the case of a digital signal.

[Effects of the Invention] As described above, according to the present invention, the selection circuit for selecting the output of a multiplexed controller is configured with a majority circuit and its diagnostic circuit, and when a failure is detected by the diagnostic circuit, the majority decision By switching the circuits, not only the controller but also the selection circuit for selecting its output can be multiplexed, and the reliability of the process control device can be greatly improved. 4,

[Brief explanation of the drawing]

FIG. 1 is a conceptual diagram of a process control device according to an embodiment of the present invention, FIG. 2 is a conceptual diagram of an embodiment of the selection circuit of FIG. 1, and FIG. 3 is a conceptual diagram of an embodiment of the diagnostic circuit of FIG. FIG. 4 is a conceptual diagram of a process control device according to another embodiment of the present invention, and FIG. 5 is a conceptual diagram showing the configuration of a conventional multiplexed process control device. 1...Process, 2A, 2B, 2C...Controller, 3
A, 3B. 3C... Selection circuit, 4... Process control device, 5A
,5B,. 5C...Intermediate value selection circuit, 6A, 6B, 6C
...Diagnostic circuit, 7... Relay, 8... Display. Figure 1 `` ■ ■ ■ ■ Peeking Tsuj i
J Figure 2 L -, -J Figure 03 Figure 4 L
JwlIS diagram

Claims (3)

[Claims] (1) In a process control device comprising a plurality of controllers that input the same signal and perform the same processing, and a selection circuit that selects and outputs a normal output signal from among the output signals from each of these controllers, the A plurality of selection circuits are provided consisting of a majority circuit and its diagnostic circuit, and one of the selection circuits is selected to obtain a control output, but when the diagnosis circuit in the selection circuit detects a failure, A process control device comprising a switching circuit for switching to a next-stage selection circuit. (2) The process control device according to claim 1, wherein the majority circuit is an intermediate value selection circuit. (3) A process control device according to claim 1, wherein the majority circuit is a majority logic circuit.