WO2020135530A1

WO2020135530A1 - Man-machine interface system having power loss protection mechanism, and distributed control system

Info

Publication number: WO2020135530A1
Application number: PCT/CN2019/128436
Authority: WO
Inventors: 薛栋; 张寅�
Original assignee: 西门子电站自动化有限公司
Priority date: 2018-12-26
Filing date: 2019-12-25
Publication date: 2020-07-02
Also published as: CN109656213B; CN109656213A

Abstract

Provided is a man-machine interface system having a power loss protection mechanism, comprising: at least one UPS power source, at least one work server, a man-machine interaction server, a power loss protection server, and a terminal bus network consisting of at least one network switch. An external power source supplies power for each server in the man-machine interface system by means of the at least one UPS power source. Each server in the man-machine interface system is connected to the terminal bus network by means of a network cable, and the power loss protection server is connected with one or more UPS power sources by means of the network cable. A UPS power source management client used for performing power loss monitoring on the connected UPS power source is provided on the power loss protection server. When the power loss of the external power source is monitored, the power loss protection server performs a shutdown operation on each server in the man-machine interface system according to the current shutdown policy by means of the terminal bus network, and the current shutdown policy comprises the shutdown sequence and the wait time of the servers in the man-machine interface system.

Description

Human-machine interface system and distributed control system with power failure protection mechanism

Technical field

The present disclosure generally relates to the field of power plants, and more specifically, to a man-machine interface system and a distributed control system for power plants with a power loss protection mechanism.

Background technique

For example, the distributed control system (Distributed Control System, DCS) produced by Siemens has been successfully used as a mature control system in many large-scale thermal and nuclear power projects at home and abroad. FIG. 1 shows a schematic diagram of a standard distributed control system 1. As shown in FIG. 1, the DCS system 1 includes a management terminal bus network 10, a human-machine interface system 20, and a factory bus network 30. The human-machine interface system 20 includes at least one work server and a terminal bus network 21. The at least one working server is, for example, a data processing server (Processing Unit, PU) 22, a service server (Service Unit, SU) 23, an operating workstation (Operating Terminal, OT) 24, an extension server (Extension unit, XU), an engineering server (Engineer Server _, ES), etc., and at least one server is connected together through the terminal bus network 21.

In the human-machine interface system 20 shown in FIG. 1, most of the work servers (for example, data processing server (Processing Unit, PU), service server (Service Unit, SU), operating workstation (Operating Terminal, OT), The extension server (Extension unit, XU) and engineering server (Engineer Server _, ES) are all based on Unix and/or Linux platforms. This kind of server has high requirements for the stability of the external power supply. If the external power supply suddenly loses power, it is likely that the system will crash or the hardware will be damaged, which will cause many problems for the subsequent operation of the unit.

Based on this situation, the industry has proposed a man-machine interface system with a power loss protection mechanism. In this human-machine interface system, each server in Figure 1 is equipped with a UPS power supply separately. After detecting that the external power supply is lost, the UPS power supply will issue a shutdown command to the corresponding server to shut down the operating system of the server one by one to avoid unnecessary losses.

FIG. 2 shows a schematic diagram of an example of a man-machine interface system 20 with a power loss protection mechanism in the prior art. As shown in FIG. 2, three

network switches

211, 212, and 213 are connected by a network cable 240 to form a terminal bus network 210. The network switch may be, for example, SCALANCE X307 produced by Siemens, or may be a network switch of another brand commercially available. The human-machine interface server 221, PU server 222, OT server 223, SU server 224, ESDBA server 225, XU server 226, and ES server 227 are respectively connected to a network switch in the terminal bus network 210 via a network cable 240. Each of the human-machine interface server 221, the PU server 222, the OT server 223, the SU server 224, the ESDBA server 225, the XU server 226, and the ES server 227 is connected to a UPS power supply 230 through a power cord 250, whereby the external power supply passes Each UPS power supply supplies power to each server in the system.

In the human-machine interface system 20 shown in FIG. 2, after the UPS power supply detects that the external power supply is lost, it will issue a shutdown command to the corresponding server one by one to shut down the operating system of the server. However, in the human-machine interface system 20, since each server needs to be equipped with a dedicated UPS power supply, the cost of the system is greatly increased, and today, with the domestic DCS striding forward, the cost will bring a decisive factor to the applicability of the product , Especially in some small and medium projects.

In addition, because the UPS power supply has been working for a long time, if the UPS power supply itself is unstable, it is very likely that the operating system on the server will not be automatically shut down.

In addition, in this kind of human-machine interface system, after the external power supply is lost, the entire upper layer network (for example, the terminal bus network) will lose power, thereby completely losing the remote operation such as shutting down the server through the upper layer network. Possibility.

Summary of the invention

In view of the above, the present disclosure provides a man-machine interface system and a DCS system with a power loss protection mechanism for power plants. With this system, when the UPS power supply detects a power failure signal, it can shut down all servers in sequence through the terminal bus network according to the established shutdown strategy, thereby ensuring that the entire system can be shut down in a timely and effective manner.

According to an aspect of the present disclosure, there is provided a man-machine interface system for a power plant with a power failure protection mechanism, including: at least one UPS power supply, at least one work server, a human-computer interaction server, a power failure protection server, and a connection A terminal bus network with at least one network switch, wherein the at least one working server, the human-computer interaction server, the power failure protection server, and at least one network switch and the at least one UPS in the terminal bus network One UPS power supply in the power supply is connected through a power cord, so that the external power supply supplies power to each server in the human-machine interface system through the at least one UPS power supply, the at least one work server, the human-computer interaction server, and The power failure protection server is connected to the terminal bus network through a network cable, and the power failure protection server is connected to one or more UPS power sources of the at least one UPS power source through a network cable, and the power failure The electrical protection server is provided with a UPS power management client, which is configured to perform power outage monitoring on the connected UPS power supply, wherein, when it is detected that the external power supply is out of power, the power outage protection server Configured to perform a shutdown operation on the at least one work server, the human-machine interaction server, and the power failure protection server according to a current shutdown strategy via the terminal bus network, the current shutdown strategy includes the human-machine interface The shutdown sequence and waiting time of each server in the system.

Optionally, in an example of the above aspect, the power failure protection server has a passwordless access function for other servers in the human-machine interface system, and the power failure protection server is configured to: A shutdown strategy is to sequentially perform a shutdown operation on the at least one work server, the human-computer interaction server, and the power failure protection server via the terminal bus network.

Optionally, in an example of the above aspect, the power failure protection server does not have a passwordless access function for other servers in the man-machine interface system, and there is a man-machine interface for the man-machine interface system Other servers in the system have a specific server with no password access function, the specific server is one of the at least one work server, the human-computer interaction server, and the power failure protection server is configured to: The specific server sends the current shutdown policy, so that the specific server executes the at least one work server, the human-computer interaction server, and the power failure protection server via the terminal bus network according to the current shutdown policy Shutdown operation.

Optionally, in an example of the above aspect, sequentially performing shutdown operations on the at least one work server, the human-computer interaction server, and the power failure protection server according to the current shutdown strategy via the terminal bus network includes: Send a shutdown instruction to the corresponding server in turn according to the shutdown sequence in the current shutdown strategy, and the shutdown instruction for each server waits for the corresponding waiting time after sending the shutdown instruction to the previous server in the shutdown sequence issued.

Optionally, in an example of the above aspect, the power failure protection server and the human-computer interaction server are Windows-based servers.

Optionally, in an example of the above aspect, the power failure protection server and the human-computer interaction server are the same server.

Optionally, in an example of the above aspect, the power failure protection server is configured to monitor the power failure of the external power supply for a predetermined period of time, and then via the terminal bus network according to the current shutdown strategy At least one work server, the human-computer interaction server, and the power failure protection server perform a shutdown operation.

Optionally, in an example of the above aspect, the power failure protection server is further configured to: obtain a current working condition of each server in the human-machine interface system and a communication failure linkage relationship between each server; and According to the current working condition of each server in the human-machine interface system and the communication failure linkage relationship between each server, the current shutdown strategy is formulated.

Optionally, in an example of the above aspect, the current shutdown strategy is a predetermined shutdown strategy stored in the power failure protection server.

Optionally, in an example of the above aspect, each of the at least one UPS power supply is configured to supply power to at least two servers in the human-machine interface system.

Optionally, in an example of the above aspect, the at least one work server includes at least one of the following servers: at least one operation server, at least one data processing server, at least one expansion server, at least one management server, and At least one business server.

Optionally, in an example of the above aspect, the human-machine interface system may further include: at least one simulation server configured to obtain working conditions and setting models of each work server; and at least one simulation server configured To simulate on-site input data and on-site output data of each working server in the human-machine interface system, wherein each simulated server in the at least one simulated server is powered by one UPS power supply in the at least one UPS power supply, And connected to the terminal bus network through a network cable.

According to another aspect of the present disclosure, there is provided a distributed control system for a power plant, including the human-machine interface system described above.

With the human-machine interface system according to the present disclosure, when the UPS power supply detects a power failure signal, it can sequentially shut down all servers in the system through the terminal bus network according to the formulated shutdown strategy, thereby ensuring that the entire system can be timely And effectively shut down steadily.

With the human-machine interface system according to the present disclosure, when the power failure protection server has a password-less access function for other servers in the human-machine interface system, if the power failure protection server detects that an external power supply has lost power, the power failure The electrical protection server sequentially shuts down all servers in the system via the terminal bus network according to the current shutdown strategy, thereby ensuring that the entire system can be shut down in a timely and effective manner.

With the man-machine interface system according to the present disclosure, when the power failure protection server does not have a passwordless access function for other servers in the man-machine interface system, if the power failure protection server detects that the external power supply has a power failure, it can be The power failure protection server sends the current shutdown strategy to a specific server in the human-machine interface system that has password-less access to other servers in the human-machine interface system, and the specific server sequentially responds via the terminal bus network according to the current shutdown strategy. All servers in the system are shut down in sequence, ensuring that the entire system can be shut down in a timely and effective manner.

With the human-machine interface system according to the present disclosure, by sequentially sending shutdown instructions to the corresponding servers according to the shutdown sequence in the current shutdown strategy, and the shutdown instruction for each server is to send shutdown to the previous server in the shutdown sequence It is issued after waiting for the corresponding waiting time after the instruction, which can ensure that the shutdown operation for the next server is started after the previous server completes the shutdown operation, so as to ensure that the entire system can be shut down in a timely and effective and stable manner without The shutdown operation of the next server may adversely affect the shutdown operation of the previous server.

By using the human-machine interface system according to the present disclosure, by implementing the power failure protection server as a Windows-based server, the power failure protection server can have a better human-computer interaction interface, thereby facilitating operations performed by operators.

With the human-machine interface system according to the present disclosure, by implementing the power failure protection server and the human-machine interaction server as the same server, the cost of the human-machine interface system can be reduced.

With the human-machine interface system according to the present disclosure, after the external power supply is monitored for power loss and lasts for a predetermined time, the power failure protection server starts to perform the shutdown operation for all servers in the system, it is possible to avoid the occurrence of short due to the external power supply Unnecessary power failure protection operation caused by time power failure.

Using the human-machine interface system according to the present disclosure, by acquiring the current operating conditions of each server in the human-machine interface system and the fault linkage relationship between each server; and according to the current operating conditions and each of the servers in the human-machine interface system According to the fault linkage relationship between the servers, the current shutdown strategy is formulated, and then the shutdown operation for all servers in the system is performed according to the formulated current shutdown strategy, which can make the formulated current shutdown strategy more in line with the current status of the system, thereby More effectively ensure that the entire system is shut down steadily.

BRIEF DESCRIPTION

By referring to the following drawings, a further understanding of the nature and advantages of the present disclosure can be achieved. In the drawings, similar components or features may have the same reference label.

Figure 1 shows a schematic diagram of a standard DCS system;

2 shows a schematic diagram of an example of a man-machine interface system with a power loss protection mechanism in the prior art;

3 shows a schematic diagram of an example of a man-machine interface system with a power loss protection mechanism according to an embodiment of the present disclosure;

4 shows a schematic diagram of an example of a human-machine interface system with a power loss protection mechanism according to an embodiment of the present disclosure;

5 shows a schematic diagram of an example of a human-machine interface system with a power loss protection mechanism according to an embodiment of the present disclosure; and

FIG. 6 shows a schematic diagram of an example of a human-machine interface system with a power loss protection mechanism according to an embodiment of the present disclosure.

Reference number

1 DCS system

10 Management terminal bus network

20, 30, 30’, 30”, 30”’ human-machine interface system

21 Terminal bus network

22 PU server

23 SU server

24 OT server

30 Factory bus network

40 Bridge

41 Automatic control equipment

210 terminal bus network

211, 212, 213 network switches

221 Human-machine interface server

222 PU server

223 OT server

224 SU server

225 ESDBA server

226 XU server

227 ES server

230 UPS power supply

240 network cable

250 power cord

310 terminal bus network

311, 312, 313 network switches

321 human-machine interface server

322 PU server

323 OT server

324 SU server

325 ESDBA server

325’ES server

326 XU server

327 Power loss protection server

328 Simulation server

329 simulation server

330 UPS power supply

340 network cable

350 power cord

360 Shutdown command transmission line

detailed description

The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that the discussion of these embodiments is merely to enable those skilled in the art to better understand and implement the subject matter described herein, and is not intended to limit the scope of protection, applicability, or examples set forth in the claims. Changes can be made in the function and arrangement of the elements in question without departing from the scope of protection of this disclosure. Various examples may omit, substitute, or add various processes or components as needed. For example, the described methods may be performed in a different order than the described order, and various steps may be added, omitted, or combined. In addition, the features described with respect to some examples can also be combined in other examples.

As used herein, the term "including" and its variations represent open terms, meaning "including but not limited to." The term "based on" means "based at least in part on." The terms "one embodiment" and "an embodiment" mean "at least one embodiment". The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc. may refer to different or the same objects. The following may include other definitions, whether explicit or implicit. Unless the context clearly indicates otherwise, the definition of a term is consistent throughout the specification.

FIG. 3 shows a schematic diagram of an example of a man-machine interface system 30 with power loss protection according to an embodiment of the present disclosure.

As shown in FIG. 3, the human-machine interface system 30 includes a terminal bus network 310 connected with at least one network switch (for example, network switches 311, 312 and 313 ), the at least one

network switch

311, 312 and 313 passing through a network cable 340 Connected. In the present disclosure, the network switch may be, for example, Siemens' SCALANCE X307 or other commercially available network switches suitable for power station applications.

The human-machine interface system 30 further includes a human-machine interaction server 321, at least one PU server 322, at least one OT server 323, at least one SU server 324, at least one management server (ESDBA server 325, and ES server 325'), at least one XU Server 326 and power failure protection server 327. In the example shown in FIG. 3, the human-computer interaction server 321 is a Windows-based server. The power failure protection server 327 may also be a server based on a Windows system or a server based on other operating systems. In other examples of the present disclosure, the power failure protection server 327 and the human-machine interaction server 321 may also be the same server.

In the present disclosure, at least one PU server 322, at least one OT server 323, at least one SU server 324, at least one management server (ESDBA server 325, and ES server 325') and at least one XU server 326 are collectively referred to as a human-machine interaction system 30 working servers. In other examples of the present disclosure, the work server of the human-machine interaction system 30 may include some or all of the above servers.

In the example shown in FIG. 3, for example, the human-machine interface server 321, a PU server 322, and a power failure protection server 327 are connected to the network switch 311 through the network cable 340, and thus connected to the terminal bus network 310. Similarly, the OT server 323 and the SU server 324 are connected to the network switch 312 through a network cable 340. The ESDBA server 325, XU server 326 and ES server 325' are connected to the network switch 313. Thus, the above servers can be connected to a network switch of the terminal bus network 310 through the network cable 340, respectively, so that each server can perform information exchange and communication through the terminal bus network 310. In FIG. 3, for simplicity, each work server only shows one server device, and in practical applications, each work server may also be equipped with two or more server devices.

The human-machine interface system 30 further includes at least one UPS power supply 330, and in the example shown in FIG. 3, two UPS power supplies 330 are included. In the example shown in FIG. 3, each UPS power supply 330 can be connected to and powered by an external power supply (not shown). At the same time, the UPS power supply 330 can also be connected to at least one of the following server devices using the power cord 350 to supply power to these devices, including human-machine interaction server 321, PU server 322, OT server 323, SU server 324, and ESDBA server 325 , At least one

network switch

311, 312, 313 in the XU server 326, the ES server 325' and the power failure protection server 327 and the terminal bus network 310. In FIG. 3, one UPS power supply 330 is connected to two or more of the above server devices through a power cord 350.

In addition, the power failure protection server 327 is also connected to one or more UPS power sources 330 of the at least one UPS power source 330 through a network cable 340. In the present disclosure, since the power failure protection server 327 can be connected to the plurality of UPS power sources 230 in the at least one UPS power source 330 through the network cable 340 and perform power loss monitoring on the plurality of UPS power sources 330, the multiple UPS When any external power supply fails in any one of the power supplies 330, the external power supply loss signal can be monitored, so that the power loss protection server 327 can prevent the power loss protection server 327 from being connected to a single UPD power supply 330 due to the The failure of the UPS power supply causes the situation that the external power supply power failure signal cannot be monitored.

The power failure protection server 327 is also provided with a UPS power management client. The UPS power management client may be configured to manage the connected UPS power supply 330, for example, perform external power supply outage monitoring on the connected UPS power supply 330. Therefore, after a power failure occurs on the UPS power supply 230, the UPS power management client on the power failure protection server 327 can monitor the power failure signal of the external power supply.

The power failure protection server 327 is also provided with a power failure protection program or power failure protection device. After detecting the power loss of the external power supply, the power loss protection program or power loss protection device is activated, so that the human-machine interaction server 321, at least one PU server 322, at least one The OT server 323, at least one SU server 324, at least one ESDBA server 325, at least one XU server 326, at least one ES server 325', and power failure protection server 327 perform a shutdown operation. For example, the power failure protection server 327 may send the shutdown instruction to the corresponding server in sequence according to the shutdown order in the current shutdown strategy via the shutdown instruction transmission line 360 shown in FIG. 3.

It should be explained here that, in the case of monitoring the external power loss, during the shutdown operation according to the current shutdown strategy, the UPS power supply connected to each network switch is used to supply power to the network switch to ensure that the terminal is executed during the shutdown operation The bus network 310 keeps working normally.

In the present disclosure, the current shutdown strategy may include the shutdown sequence and waiting time of each server in the human-machine interface system. In the present disclosure, the shutdown sequence and waiting time of each server may be determined according to the working conditions of each server in the human-machine interface system 30 and the communication failure linkage relationship between each server. Here, the working condition of each server refers to the working condition of the server, that is, how many programs are currently running and the current execution status of each program. The communication failure linkage relationship refers to a communication failure that occurs if server B is not shut down due to the shutdown of server A. For example, if server A is shut down, if server B is not shut down, server B will have a communication failure due to the shutdown of server A, for example, the data of server B will be lost. In this case, Server A is considered to have a communication failure linkage relationship with Server B, and in the shutdown policy, the shutdown sequence of Server A is set after the shutdown sequence of Server B.

In addition, in the example shown in FIG. 3, the power failure protection server 327 may be set to have a password-less access function for other servers in the human-machine interface system, and the current shutdown policy may be stored in the power failure protection server 327 Scheduled shutdown strategy. In this case, after the UPS power management client on the power failure protection server 327 detects an external power failure on a UPS power supply 330, the power failure protection server 327 is configured as follows: The stored predetermined shutdown strategy to the human-computer interaction server 321, at least one PU server 322, at least one OT server 323, at least one SU server 324, at least one ESDBA server 325, at least one XU server 326, at least one via the terminal bus network 310 An ES server 325' and a power failure protection server 327 perform a shutdown operation.

In an example of the present disclosure, the human-machine interaction server 321, at least one PU server 322, at least one OT server 323, at least one SU server 324, at least one ESDBA server 325, at least One XU server 326, at least one ES server 325' and the power failure protection server 327 performing the shutdown operation may include: sequentially sending a shutdown instruction to the corresponding server according to the shutdown sequence in the current shutdown strategy, and preferably, shutting down for each server The instruction is issued after waiting for a corresponding waiting time after sending a shutdown instruction to the previous server in the shutdown sequence.

For example, suppose PU322, OT323, SU324, ESDBA325 are servers of Linux operating system, power failure protection server 327 and human-computer interaction server 321 are the same server based on Windows operating system Eng-server, ES325' (for example, (ES680) is a server of the Solaris operating system, and the UPS power management client and the power failure protection program (ie, execution script) are both configured on the power failure protection server 327.

When an event such as loss of external power supply occurs, in order to protect all servers to shut down safely. A power failure protection program (ie, execution script) is executed on the power failure protection server 327 (ie, Windows server Eng-server), and the execution script will shut down each server in accordance with the current shutdown policy that has been formulated.

For example, in the above case, since both the OT and SU require the PU to operate normally to work properly. If the PU stops running, the OT and SU will automatically enter the fault state, so when stopping the server, you need to stop the OT and SU first, and then stop the PU. Therefore, in the formulated shutdown strategy, the shutdown sequence of OT and SU is before PU. For example, the current shutdown sequence can be OT->SU->PU->ES>ESDBA->Eng-server, and the waiting time of OT is 20s, the waiting time of SU is 20s, the waiting time of PU is 30s, and the waiting of ES The time is 20s and the waiting time of ESDBA is 20s.

The execution sequence flow of the power failure protection program script may be, for example: After detecting the failure of the external power supply, the server Eng-server runs the server shutdown script "remote_shutdownt2k.sh" to perform the shutdown operation on each server according to the current shutdown strategy. Specifically, first, send the first shutdown instruction to the server OT to cause the server OT to stop its operation monitoring (OM) service and perform shutdown, and wait 20s after issuing the first instruction, and then send the second instruction to the server SU The shutdown instruction causes the server SU to stop its OM service and perform shutdown. Then, after issuing the second instruction, wait 20s, and then send a third shutdown instruction to the server PU, so that the server PU stops its OM service and performs shutdown. After issuing the third instruction, wait 30 seconds, and issue a fourth shutdown instruction to the server ES, so that the server ES stops its OM service and performs shutdown. After issuing the fourth instruction, wait 20s, and issue a fifth shutdown instruction to the server ESDBA, so that the server ESDBA stops its OM service and performs shutdown. After issuing the fifth instruction, wait for 20s and issue the sixth shutdown instruction to the server Eng-server, so that the server stops the Eng-server OM service and performs shutdown.

In addition, in an example of the present disclosure, the power failure protection server 327 may also be set to have no password-less access function for other servers in the human-machine interface system. Fig. 4 shows a schematic diagram of an example of a human-machine interface system 30' with a power loss protection mechanism according to an embodiment of the present disclosure. Unlike FIG. 3, the human-machine interface system 30′ shown in FIG. 4 includes a specific server having a password-less access function for other servers in the human-machine interface system, the specific server being the at least one working server and the human-machine One of the interaction servers 321, for example, the human-computer interaction server 321 or the server ESDBA325. Correspondingly, the shutdown operation instruction for each server in the system is issued by the server ESDBA, not by the power failure protection server 327.

After the UPS power management client on the power failure protection server 327 detects an external power failure signal, the power failure protection server 327 is configured to: send a shutdown instruction to a specific server (server ESDBA), so that the specific server (server ESDBA) ) Perform shutdown operations on at least one operation server, at least one data processing server, at least one expansion server, at least one service server, human-computer interaction server, and power failure protection server via the terminal bus network according to the current shutdown strategy.

Specifically, the execution sequence of the power failure protection program script is: after detecting the failure of the external power supply, the power failure protection server 327 runs "shutdownall.cmd" and sends a shutdown instruction to the server ESDBA. Then the server ESDBA runs "remote_shutdownt2k.sh" to perform the server shutdown operation according to the server shutdown sequence. Specifically, first, send the first shutdown instruction to the server OT to cause the server OT to stop its OM service and perform shutdown, and wait 20s after issuing the first instruction, and then send a second shutdown instruction to the server SU to stop the server SU Its OM service and perform shutdown. Then, after issuing the second instruction, wait 20s, and then send a third shutdown instruction to the server PU, so that the server PU stops its OM service and performs shutdown. After issuing the third instruction, wait 30 seconds, and issue a fourth shutdown instruction to the server ES, so that the server ES stops its OM service and performs shutdown. After issuing the fourth instruction, wait 20s, so that the server ESDBA stops its OM service and performs shutdown. Then, after the power-off protection server 327 issues a shutdown instruction, it waits for 110 s, so that the power-off protection server 327 stops its OM service and performs shutdown.

In another example of the present disclosure, the power-off protection server 327 may not store a predetermined shutdown policy in advance. Correspondingly, the power failure protection server 327 may also be configured to: obtain the current working conditions of each server in the human-machine interface system and the fault linkage relationship between each server; and based on each server in the acquired human-machine interface system The current working conditions and the fault linkage relationship between each server, formulate the current shutdown strategy. For example, the power failure protection server 327 may determine the time required for the system on each server to shut down based on the acquired current operating conditions of each server, that is, the waiting time corresponding to the server. In addition, the power failure protection server 327 may determine the shutdown sequence of each server based on the acquired fault linkage relationship between each server.

Then, the power failure protection server 327 responds to the human-machine interaction server 321, at least one PU server 322, at least one OT server 323, at least one SU server 324, and at least one ESDBA server 325 via the terminal bus network 310 according to the established current shutdown strategy , At least one XU server 326, at least one ES server 325', and power failure protection server 327 perform a shutdown operation.

In another example of the present disclosure, the power failure protection server 327 may also be configured to start the shutdown according to the current shutdown via the terminal bus network 310 after detecting that the external power supply has been powered off for a predetermined time (for example, for a predetermined minute). The policy is to the human-computer interaction server 321, at least one PU server 322, at least one OT server 323, at least one SU server 324, at least one ESDBA server 325, at least one XU server 326, at least one ES server 325' and power failure protection server 327 Perform shutdown operation.

In addition, optionally, in one example of the present disclosure, the power failure protection program or power failure protection program of the power failure protection server 327 may also be implemented in the UPS power management client.

In addition, optionally, in one example of the present disclosure, each of the at least one UPS power supply may be configured to supply power to at least two servers in the human-machine interface system. For example, a 1500VA UPS power supply can guarantee the short-term power supply of 4 servers, thereby greatly saving the corresponding project cost.

5 shows a schematic diagram of an example of a human-machine interface system 30" with a power loss protection mechanism according to an embodiment of the present disclosure. The human-machine interface system 30" shown in FIG. 5 is shown in FIG. 3. The improvement of the human-machine interface system 30. The improved human-machine interface system is suitable for a simulation machine system, for example, the SPPA-S2000 (FSS) system of Siemens.

Compared with FIG. 3, in addition to the components shown in FIG. 3, the human-machine interface system 30" shown in FIG. 5 further includes: at least one simulation server 328 and at least one simulation server 329. At least one simulation server 328 is Configured to obtain the current working conditions and set models of each server; and at least one simulation server 329 is configured to simulate the field input data and field output data of each server in the human-machine interface system. In addition, the at least one simulation Each simulated server in the server 329 is powered by one of the at least one UPS power supply, and is connected to the terminal bus network 310 through a network cable 340.

Similar to FIG. 3, the power failure protection server 327 in the human-machine interface system 30" shown in FIG. 5 has a passwordless access function for other servers in the human-machine interface system, and the server shutdown operation is performed by the power failure protection server 327. The server shutdown operation of the power failure protection server 327 in FIG. 5 may be similar to the server shutdown operation described above with reference to FIG. 3. For example, in one example, the shutdown sequence of each server may be OT->SU ->PU->ES>ESDBA->SimServer (simulation server)->EmuServer (simulation server)->Eng-server.

FIG. 6 shows a schematic diagram of an example of a human-machine interface system 30”′ with power loss protection according to an embodiment of the present disclosure. The structure in FIG. 6 is completely the same as that in FIG. 5, except that FIG. 6 The power failure protection server in the human-machine interface system 30 ″ shown in FIG. 3 does not have a passwordless access function for other servers in the human-machine interface system, and the server shutdown operation is performed by the server ESDBA325. The server shutdown operation of the power failure protection server 327 in FIG. 6 may refer to the server shutdown operation described above with reference to FIG. 4. For example, in an example, the shutdown sequence of each server may be OT->SU->PU->ES>ESDBA->SimServer->EmuServer->Eng-server.

The specific embodiments described above in conjunction with the drawings describe exemplary embodiments, but do not represent all embodiments that can be implemented or fall within the scope of protection of the claims. The term "exemplary" used throughout this specification means "used as an example, instance, or illustration" and does not mean "preferred" or "advantageous" over other embodiments. For the purpose of providing an understanding of the described technology, the detailed description includes specific details. However, these techniques can be implemented without these specific details. In some instances, in order to avoid making the concept of the described embodiments difficult to understand, well-known structures and devices are shown in block diagram form.

The above description of the present disclosure is provided to enable any person of ordinary skill in the art to implement or use the present disclosure. For those of ordinary skill in the art, various modifications to the present disclosure are obvious, and the general principles defined herein may also be applied to other variations without departing from the scope of protection of the present disclosure . Therefore, this disclosure is not limited to the examples and designs described herein, but is consistent with the broadest scope consistent with the principles and novel features disclosed herein.

Claims

A man-machine interface system (30) with power failure protection mechanism for power plants includes: at least one UPS power supply (330), at least one work server, human-machine interaction server (321), and power failure protection server (327) ) And a terminal bus network (310) connected with at least one network switch,

Wherein, the at least one working server, the human-computer interaction server (321), the power failure protection server (327) and the terminal bus network (310) at least one network switch and the at least one UPS power supply One UPS power supply (330) in (330) is connected through a power cord (350), so that an external power supply passes through the at least one UPS power supply (330) to each server and network in the human-machine interface system (30) Switch power supply,

The at least one working server, the human-computer interaction server (321) and the power failure protection server (327) are connected to the terminal bus network (310) through a network cable (340), and the power failure protection The server (327) is connected to one or more UPS power supplies (330) of the at least one UPS power supply (330) through a network cable (340), and

A UPS power management client is provided on the power failure protection server (327), the UPS power management client is configured to perform external power failure monitoring on the connected UPS power supply (330),

When it is detected that the external power supply loses power, the power failure protection server (327) is configured to interact with the at least one working server and the human-computer interaction according to the current shutdown strategy via the terminal bus network (310) The server (321) and the power failure protection server (327) perform a shutdown operation, and the current shutdown strategy includes the shutdown sequence and waiting time of each server in the human-machine interface system (30).
The human-machine interface system (30) of claim 1, wherein each of the at least one UPS power supply (330) is configured to provide at least one of the human-machine interface systems (30) Both servers are powered.
The human-machine interface system (30) according to claim 1, wherein the power failure protection server (327) has a passwordless access function for other servers in the human-machine interface system (30), and the lost The electrical protection server (327) is configured to:

According to the current shutdown strategy, a shutdown operation is performed on the at least one work server, the human-computer interaction server (321), and the power failure protection server (327) via the terminal bus network (310).
The human-machine interface system (30) according to claim 1, wherein the power failure protection server (327) does not have a passwordless access function for other servers in the human-machine interface system (30), the person There is a specific server in the machine interface system (30) that has a password-less access function for other servers in the man-machine interface system, and the specific server is the at least one work server and the human-computer interaction server (321) One, and the power failure protection server (327) is configured to:

Sending the current shutdown strategy to the specific server, so that the specific server responds to the at least one working server and the human-computer interaction server (321) via the terminal bus network (310) according to the current shutdown strategy ) And the power failure protection server (327) perform a shutdown operation.
The human-machine interface system (30) according to any one of claims 1 to 4, wherein the at least one work server and the human-machine interaction server are processed according to the current shutdown strategy via the terminal bus network (310) (321) and the power-off protection server (327) performing the shutdown operation includes:

Send a shutdown instruction to the corresponding server in turn according to the shutdown sequence in the current shutdown strategy, and the shutdown instruction for each server waits for the corresponding waiting time after sending the shutdown instruction to the previous server in the shutdown sequence issued.
The human-machine interface system (30) according to claim 1, wherein the power failure protection server (327) and the human-computer interaction server (321) are Windows-based servers.
The human-machine interface system (30) according to claim 6, wherein the power failure protection server (327) and the human-machine interaction server (321) are the same server.
The human-machine interface system (30) according to claim 1, wherein the power failure protection server (327) is configured to pass the terminal bus network (310) after detecting the power failure of the external power supply for a predetermined time ) To perform a shutdown operation on the at least one work server, the human-computer interaction server (321), and the power failure protection server (327) according to the current shutdown strategy.
The human-machine interface system (30) according to claim 1, wherein the power failure protection server (327) is further configured to:

Acquiring the current working condition of each server in the human-machine interface system (30) and the communication failure linkage relationship between each server; and

According to the current working condition of each server in the human-machine interface system (30) and the communication failure linkage relationship between each server, the current shutdown strategy is formulated.
The human-machine interface system (30) of claim 1, wherein the current shutdown strategy is a predetermined shutdown strategy stored in the power failure protection server (327).
The human-machine interface system (30) of claim 1, wherein the at least one work server comprises at least one of the following servers:

At least one data processing server (322),

At least one operation server (323),

At least one business server (324),

At least one management server (325, 325’), and

At least one expansion server (326).
The human-machine interface system (30) according to claim 11, further comprising:

At least one simulation server (328) configured to obtain the working conditions and setting models of each working server;

At least one simulation server (329) configured to simulate field input data and field output data of each working server in the human-machine interface system,

Wherein, each simulation server in the at least one simulation server (329) is powered by one UPS power supply (330) in the at least one UPS power supply (330), and is connected to the terminal through a network cable (340) Bus network (310).
A distributed control system for a power plant includes the human-machine interface system (30) according to any one of claims 1 to 12.