JPS6275703A - Triplex controller - Google Patents

Abstract

PURPOSE:To detect an abnormal point not only in arithmetic sections but also in transmitting sections without increasing the burdens of the arithmetic sections, by connecting three transmitting sections with each other by means of mutual data communicating lines. CONSTITUTION:Three arithmetic sections 1A-1C are coupled with each other by means of mutual synchronization lines 2 and mutual data communicating lines 3 and each arithmetic section 1A-1C is coupled with each PIO section 4 by means of a bus line 8. A transmitting section equipped with a microprocessor for controlling serial transmission is provided at each arithmetic section of these tripled arithmetic sections and the three transmitting sections can operate independently so that the arithmetic sections can maintain their independency. Moreover, high-speed information exchange can be secured between the arithmetic sections and transmitting sections by closely coupling both the sections with high-speed parallel buses and, at the same time, the transmitting sections only can discriminate the quality of information, abnormality of transmitting sections, etc., without passing through the arithmetic section by connecting the transmitting sections with each other by means of mutual data communicating lines.

Description

DETAILED DESCRIPTION OF THE INVENTION [Technical Field of the Invention] The present invention relates to a triplex control device for highly reliable monitoring and control of nuclear power plants and the like.

[Technical background of the invention and its problems] In recent years, with the advancement of semiconductor integration technology, microprocessors have become more efficient and more compact, and digital control devices using microprocessors have become easily available.

For this reason, in control devices for important plants such as nuclear power plants, a triplex configuration has been adopted for the calculation section of the control device in order to improve safety and availability.

Now, if we consider the case where this triplex configuration is applied to, for example, a lower-level field-side control device connected to a higher-level control device, the three calculation units of the triplex control system will be connected to the upper-level control device via each transmission device. connected to each control device. At the same time, each input/output section (hereinafter referred to as PIO section) is connected to a plant output point via a voter.

With this configuration, the final outputs of the three systems including the arithmetic unit are selected by the voteter, for example, based on the majority vote principle, and output to the plant. Therefore, even if an abnormality occurs in one system, as long as the two systems are normal, normal output can always be maintained and plant control can be continued safely.

However, in this case, the broken L system should be repaired immediately and 3
If the redundant configuration is not restored, the reliability of the two systems will drop significantly and control safety will no longer be guaranteed.

Therefore, when an abnormality in one system is found.

It is also necessary to detect the abnormal location, but detecting the abnormal location by the calculation unit including the transmission unit has the problem of increasing the load on the calculation unit and slowing down the processing speed.

[Object of the Invention] The present invention aims to provide a highly reliable triplex control device that enables high-speed processing that can detect abnormalities including the transmission section without increasing the load on the calculation section. purpose.

[Summary of the Invention] Therefore, the present invention provides a transmission unit having a microprocessor for controlling serial transmission for each of the triplexed calculation units, and allows the three transmission units to operate independently. Remain independent? 'iL calculation section and transmission section are tightly coupled with a high-speed parallel bus to ensure high-speed information exchange, and by connecting the three transmission sections with mutual data communication lines, the calculation section can be The feature is that it is possible to determine the quality of information, abnormalities in the transmitting parts, etc. only between the transmitting parts without having to go through the transmitting parts.

[Embodiments of the Invention] The present invention will be described in detail below. FIG. 1 is a configuration diagram of a triplex control device according to an embodiment of the present invention.

Three arithmetic units IA to IC are connected by a mutual synchronization line 2 and a mutual data communication line 3. The PIO section 4 and the input/output point 5 are connected via an input/output line 6 and a voter 7. Further, each of the calculation units IA to IC and each PIO unit 4 are connected by a path line 8.

Here, the input/output line 6 and the voter 7 are lines corresponding to each point of process information, and in the figure, only the input/output line 6 and the voter 7 for the two process information points are drawn, and the others are omitted. In other words, since multiplexing is performed for each point of process information, PIO
This is fundamentally different from a system in which the area just before the section (up to pass line 8) is multiplexed. This is because the triplex system is created with ultra-high reliability in mind, and it is desired to reduce the portions that are not multiplexed as much as possible. Therefore, a voter 7 is required that outputs each point of process information based on the majority vote principle or intermediate value selection. Under such a hardware environment, the software in each calculation unit runs independently while synchronizing and communicating with each other, and inputs and outputs from processes completely separately.The parts that are not multiplexed are and the cable beyond that. By the way.

Voter 7 is required only for output; digital output consists of one relay for each prefecture, and analog output consists of only several resistors per Voter. (at least) reliability is very high, and the failure mode is simple.

Each transmission section 9A-9c is connected to each calculation section IA-IC via a high-speed parallel bus 10. Transmission section 9A~
Connected to 9C are a serial transmission line 11 for connection with other arithmetic and control units, a mutual synchronization line 12 for mutual communication between transmission units, and a mutual data communication line 13, respectively.

With the above configuration, basically the three systems independently calculate and transmit exactly the same information. This is to improve reliability by performing the same input/arithmetic processing at three locations as described above, processing the results at the voter 7, and outputting them to the process. Further, although the calculation section and the transmission section exchange information via a high-speed parallel bus, this is mainly for exchanging transmission data and is not intended for exchanging control commands that restrict mutual operations. In other words, the calculation section and transmission section basically operate independently.
One is not controlled by the other. Of course, they exchange operational status and view each other as allies, but they do not control each other. In this way, since most of the information exchanged between the arithmetic unit 10 and the transmission unit 9 is transmission data, the amount of data is large, so it is best to connect them using a high-speed parallel bus 10. In general, the transmission units 9A to 9 are directly connected to the internal buses of the calculation units IA to IC.
Connect C. What is important here is that the relationship between the calculation section 1 and the transmission section 9 is rough in terms of software. This relieves the calculation units IA-IC from the work of serial transmission.

In other words, if there is a close relationship between the calculation unit 1 and the transmission unit 9, and the calculation units IA to IC must control the transmission units 9A to 9C, it is natural that the calculation units IA to IC will be responsible for the transmission work. This is because you will have to do so. In this method, the calculation units IA to IC are the transmission unit 9A.
All you need to do is exchange data with ~9C, and you are not burdened with transmission work.

Next, the roles of the mutual synchronization line and mutual communication data line 13 for mutual communication between the transmitting sections are as follows.
This is to check the serial transmission data and the health of the transmission unit 9 itself by exchanging information between them, and specifically, it is used as follows.

FIG. 2 is a time chart showing the progress of processing from receiving serial data to sending information to the arithmetic unit.

The process is roughly divided into four phases.

These are a serial transmission (reception) phase, a communication phase between transmission units, a communication phase between the transmission unit and the calculation unit, and a communication phase between the calculation units. FIG. 2(a) shows an example when all three systems successfully receive serial data, and FIG. 2(b) shows an example when one of the three systems fails to receive the serial data.

Serial transmission data 14 sent via the serial transmission line 11 from another arithmetic and control device is sent to three systems almost simultaneously in the serial transmission phase. This is because the transmission sections of other stations are also synchronized using mutual synchronization lines.

If the received result is normal, it can be checked whether the transmission was normal or not by performing a CRC check on each transmission unit 9A to 9C in each prefecture. The inspection results are communicated in the communication phase between transmission sections 1
By performing step 5, each of the transmitting units 9A to 9C can mutually check whether the other has succeeded in reception. If reception is successful in all three systems, each exchanges data 16 with the calculation unit in the transmission unit-operation unit communication phase.

In the case of an abnormality, if one system fails to receive data, the failed system confirms this through communication 15 between the transmission section, and then confirms that it has failed in reception during the transmission section-computation section communication phase. Data 17 indicating this is sent to the calculation section.

In the calculation units IA to IC that received this, it is understood that the data received by the white system is not transmission data without the need for communication 18 between calculation units in the communication phase between calculation units, so that data is processed. It doesn't work, and you can immediately tell which transmission section in other systems has an abnormality.

If an abnormality is detected in the communication 18 between the calculation parts even though the reception is normal and the communication 15 between the transmission parts is also normal, if something happens during the data exchange between the transmission part and the calculation part. This means that there is an abnormality, and it becomes possible to identify the location of the abnormality.

By communicating between the transmitting sections in this manner, even if an abnormality occurs in the transmitting sections 9A to 9C, the abnormality can be detected without placing a burden on the calculating sections IA to tC.

Note that the mutual synchronization lines 2 and 12 and the mutual data communication lines 3 and 13 are connected between the transmission units 9A to 90 and between the calculation units IA to IC.
In order to maintain hardware independence between the three systems, it is better to connect them serially and use photocouplers or optical fibers (8) to isolate them.By doing so, each system in the triplex system can be connected using a completely separate power supply. It is now possible to operate the device while keeping it grounded separately.

[Effects of the Invention] As described above, according to the present invention, it is possible to detect abnormalities including the transmission section without increasing the load on the calculation section, and a triplex control device capable of fast processing is provided. is '4j).

[Brief explanation of drawings]

Fig. 1 is a block diagram of a triplex control device showing an embodiment of the present invention, and Fig. 2 shows the progress of processing in the device from receiving serial data to sending information to the calculation section. In the time charts, (a) is a time chart in the normal case, and (b) is a time chart in the case where an abnormality occurs. 9A to 9C...transmission section, 10...high speed parallel bus. 11... Serial transmission line, 12... Line for mutual synchronization, 13... Line for mutual data communication.

Claims (1)

[Claims] 3 connected to a transmission line that transmits data serially
a mutual synchronization line and a mutual data communication line provided between these three transmission units for processing synchronization and data exchange, and a high-speed parallel bus between the three transmission units. three arithmetic units connected through the arithmetic unit, a line for mutual synchronization and a line for mutual data communication provided between the arithmetic units for synchronizing the processing of these three arithmetic units and exchanging data, and a line for mutual synchronization and mutual data communication between the three arithmetic units; The present invention includes three input/output sections connected to the section via a data bus, and a voter that selects and outputs one appropriate piece of data from each data output from these three input/output sections. Features a triplex control device.