JP2006344023A - Control unit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a control unit which duplicates a control part and input/output means for an object to be controlled and which can surely switch to a manual operation. <P>SOLUTION: The control unit is provided with: a duplicated A-system CPU part 1 and B-system CPU part 2 one of which is in a control state and the other of which is in a standby state for a plant equipment system 7, and which create control data for controlling the plant equipment system 7 in either control state or standby state; a duplicated A-system input/output means 3 and B-system input/output means 4 which transmit an input signal from the plant equipment system 7 to the A-system CPU part 1 and B-system CPU part 2 and transmit control data to the plant equipment system 7; a manual operation part 11 which is connected with the A-system input/output means 3 and B-system input/output means 4 and transmits manual control data for the plant equipment system 7; and diagnosis means 31, 41 which receive both control data output from the A-system CPU part 1 and B-system CPU part 2, and switch operation of a manual operation part 8 when both of the control data are not detected over a predetermined period of time. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a control device for controlling a control object such as a nuclear power plant having two control units in which one is in a control state and the other is in a standby state.

  A conventional control device that enables manual operation backup includes a plant control system that performs automatic control, a plant, a deviation calculation unit that obtains a deviation between a control amount and a target value from the plant, an adjustment control unit, and plant control. It consists of an abnormality monitoring system that detects system errors and switches to manual operation. The abnormality monitoring system is composed of an abnormality detection unit, an analysis command unit, and a man-machine interface unit. Then, it is assumed that an abnormality has occurred in the adjustment control unit in the plant control system. At this time, the control output for adjusting the plant cannot obtain an appropriate output, and an abnormal deviation occurs between the output of the adjustment control unit and the controlled variable from the plant. Detect abnormalities in the control system. In response, the analysis command unit determines whether to switch to manual operation, and sends a manual switching command to the adjustment control unit and the man-machine interface unit. Thereby, after that, an operator engineer can manually operate via the man-machine interface unit (see, for example, Patent Document 1). In addition, as a duplicated apparatus, the control unit is duplicated, but the response when the duplicated control units fail at the same time is not considered (for example, see Patent Document 2). ).

JP 2000-89801 A JP-A-8-255115

  As described above, the conventional control device has a single plant control unit, or even if it is duplicated, manual backup is not taken into consideration, so it can only be applied to systems that do not require manual operation. It is. However, when a nuclear power plant or the like is to be controlled, high reliability is required, and the plant control unit is duplicated, and when the duplicated plant control unit fails at the same time, manual backup is required. . Further, in that case, there is a problem that the manual operation cannot be performed when the duplicated CPU units fail at the same time only by duplicating the plant control unit and providing the input / output means with a manual operation interface.

  The present invention has been made to solve the above-described problems, and the control unit and the input / output means can be duplicated with respect to the controlled object and can be reliably switched to manual operation. The object is to obtain a control device.

  According to the present invention, a duplicated first for creating control data for controlling a control object in either a control state or a standby state, with one being in a control state and the other being in a standby state with respect to the control object. The control unit and the second control unit, and an input signal from the control object is sent to the first control unit or the second control unit and the control data is transmitted to the control object. In a control device including an output unit and a second input / output unit, a manual operation unit connected to the first input / output unit and the second input / output unit, respectively, for transmitting manual control data of a controlled object; If both control data output from the first control unit and the second control unit are received by the first input / output unit and the second input / output unit and both control data are not detected for an arbitrary time, the manual operation unit Manual operation first switch It is obtained by a cross section and a second diagnostic means.

  The control device according to the present invention is duplicated for generating control data for controlling a control object in either the control state or the standby state, with one being in the control state and the other being in the standby state. The first control unit and the second control unit, and the second signal that is input to the control target is sent to the first control unit or the second control unit, and the control data is transmitted to the control target. In a control device having one input / output means and a second input / output means, a manual operation unit connected to the first input / output means and the second input / output means, respectively, for transmitting manual control data of a controlled object When both control data output from the first control unit and the second control unit are received by the first input / output unit and the second input / output unit and both control data are not detected for an arbitrary time, Switching of manual operation in the operation unit First since a diagnosis means and the second diagnostic means that can be reliably switched to manual operation.

Embodiment 1 FIG.
Embodiments of the present invention will be described below. FIG. 1 is a block diagram showing a configuration of a control device according to Embodiment 1 of the present invention, and FIG. 2 is a block diagram showing a configuration of a manual operation unit of the control device shown in FIG. In the figure, the control device indicates that control data for controlling the plant equipment system 7 is controlled in either the control state or the standby state with respect to the plant equipment system 7 as a control object. However, the A-system CPU unit 1 as the first control unit which has the same configuration and is duplicated, and the B-system CPU unit 2 as the second control unit are provided. The A system CPU unit 1 and the B system CPU unit 2 can communicate with each other by the signal communication units 11 and 21, respectively. The self-diagnosis units 10 and 20 detect an abnormality in the A system CPU unit 1 and the B system CPU unit 2. If the determination means 12 and 22 determine that it is difficult to execute the control calculation, the switching means 13 and 23 switches the CPU unit to which it belongs from the control system to the standby system, and the signal communication means 11 and 21 A switching signal is transmitted to the CPU section.

  Further, the first input / output is duplicated with the same configuration in which the input signal from the plant equipment system 7 is sent to the A system CPU section 1 or the B system CPU section 2 and the control data is transmitted to the plant equipment system 7. A system input / output means 3 as means and B system input / output means 4 as second input / output means are provided. The A-system CPU unit 1 and the B-system CPU unit 2 transmit and receive data in order to output calculation results from the control calculation units 15 and 25 and to input data for calculation to the control calculation units 15 and 25. Data is transmitted / received to / from the A-system input / output means 3 and the B-system input / output means 4 through the means 14a, 14b, 24a, 24b. In the A system input / output means 3 and the B system input / output means 4, data transmission / reception means 30a, 30b, 40a, 40b perform data transmission / reception with the A system CPU unit 1 and the B system CPU unit 2. In the A-system input / output means 3 and the B-system input / output means 4, both control data of the A-system input / output means 3, the B-system input / output means 4 and the data transmission / reception means 30a, 30b, 40a, 40b are received. When control data is not detected for an arbitrary period of time, diagnostic means 31 and 41 are provided as first and second diagnostic means for self-diagnosing and outputting received data for switching operation of the manual operation unit 8.

  Data transmission / reception means 14a, 14b, 24a, 24b on the A system CPU section 1 and B system CPU section 2 side, and data transmission / reception means 30a, 30b, 40a, 40b on the A system input / output means 3 and B system input / output means 4 side Are connected by data transmission lines 5a, 5b, 6a and 6b as signal lines. In general, the A-system CPU unit 1 and the B-system CPU unit 2 are installed in a control room or the like that is away from the plant equipment system 7, and the A-system input / output means 3 and the B-system input / output means 4 are installed in the plant. It is installed in the vicinity of the plant equipment system 7 in order to transmit / receive data to / from the equipment system 7.

  The manual operation unit 8 includes an automatic mode selection switch 81 for switching to the automatic mode, a manual mode selection switch 82 for switching to the manual mode, a control data UP switch 83 for increasing the control data, and DOWN the control data. The control data DOWN switch 84 is connected to the A-system input / output means 3 and the B-system input / output means 4 and outputs manual control data for controlling the plant equipment system 7 via these. To do. The A-system input / output means 3 and the B-system input / output means 4 are manually operated interface (hereinafter abbreviated as I / F) means 32 and 42 for taking in manual control data of the manual operation unit 8, and manually When the automatic / manual mode is switched by the automatic / manual switching signal of the manual operation unit 8 input via the operation I / F means 32, 42, and further, the diagnosis means 31, 41 detects an abnormality. The automatic / manual switching means 33, 43 for switching to the manual mode, and the received data from the data transmitting / receiving means 14a, 24b are output as control data to the plant equipment system 7 in the automatic mode, and the manual operation I / F means 32 in the manual mode. , 42 and control data output means 34 and 44 for outputting manual control data input to the plant equipment system 7.

  Next, the operation of the control device of the first embodiment configured as described above will be described. First, the operation when switching from the manual operation unit 8 to the manual mode will be described. The A system CPU unit 1 and the A system input / output means 3 are enabled to output control data to the plant equipment system 7. The B-system CPU unit 2 and the B-system input / output means 4 are disabled so that control data is not output to the plant equipment system 7. That is, here, the A system CPU unit 1 is in the control state and the B system CPU unit 2 is in the standby state. In this state, the operator depresses the manual mode selection switch 82 in the manual operation unit 8 to select the manual mode. Next, the switch signal is transmitted to the automatic / manual switching means 33 and 43 via the manual operation I / F means 32 and 42, respectively.

  Next, the automatic / manual switching means 33, 43 receives the signal and outputs to the control data output means 34, 44 that it operates in the manual mode. The control data output means 34 and 44 receive the manual mode signal and stop outputting the control data that has been transmitted from the A system CPU unit 1 and the B system CPU part 2 and received by the data transmitting / receiving means 30a and 40b until then. . Specifically, the control data value at the moment when the manual mode signal is input is held, and thereafter the control data is increased or decreased according to the operation of the control data UP switch 83 and the control data DOWN switch 84. The control data of the manual operation unit 8 is increased or decreased when the A system CPU unit 1 reads the output value of the control data from the control data output unit 34 of the A system input / output unit 3 via the data transmission / reception units 30a and 14a. The value is transmitted to the B-system input / output means 4 via the data transmitting / receiving means 14b and 40a. As a result, the values of the A system input / output means 3, the B system input / output means 4, and the control data are matched.

  Next, an operation when both the A-system CPU unit 1 and the B-system CPU unit 2 are abnormal and switched to the manual mode will be described. First, it is assumed that an abnormality that makes it difficult for the A-system CPU unit 1 in the control state to execute a control calculation has occurred. At this time, the self-diagnosis means 10 in the A-system CPU unit 1 detects an abnormality, the determination means 12 determines that it is difficult to execute the control calculation, and the switching means 13 switches from the control system to the standby system. At the same time, a switching signal is transmitted from the signal communication means 11 to the B-system CPU unit 15. Next, the switching unit 13 instructs the data transmission / reception units 14a and 14b to stop data transmission / reception. The B system CPU unit 2 receives the switching signal from the A system CPU unit 1 and newly becomes a control system. And the control state is continued. In this state, it is further assumed that an abnormality that makes it difficult to execute the control operation occurs in the B-system CPU unit 2. At this time, the self-diagnosis means 20 in the B-system CPU unit 2 detects an abnormality, the determination means 22 determines that it is difficult to execute the control calculation, and the switching means 23 switches from the control system to the standby system. At the same time, a switching signal is transmitted from the signal communication means 21 to the A system CPU unit 15. Next, the switching means 23 instructs the data transmission / reception means 24a, 24b to stop data transmission / reception.

  Therefore, data is not transmitted from any of the data transmission / reception means 14a and 14b in the A system CPU unit 1 and the data transmission / reception means 24a and 24b in the B system CPU unit 2. At this time, for example, in the A-system input / output means 3 and the B-system input / output means 4, the diagnosis means 31 and 42 receive no data from any of the data transmission / reception means 30a, 30b, 40a, and 40b for an arbitrary time or longer. Upon detection, an abnormality occurrence (signal for switching to manual operation) is transmitted to the automatic / manual switching means 33, 43 and the control data output means 34, 44. Next, the automatic / manual switching means 33, 43 receives the signal and switches to the manual mode. The control data output means 34 and 44 hold the value of the control data immediately before receiving the signal. Thereafter, the A-system input / output means 3 and the B-system input / output means 4 operate in the manual mode, and the control data can be increased or decreased according to the operation of the manual operation unit 8. The control data of the manual operation unit 8 is increased or decreased when the A system CPU unit 1 reads the output value of the control data from the control data output unit 34 of the A system input / output unit 3 via the data transmission / reception units 30a and 14a. The value is transmitted to the B-system input / output means 4 via the data transmitting / receiving means 14b and 40a. As a result, the values of the A system input / output means 3, the B system input / output means 4, and the control data are matched.

  Next, the operation when the B-system CPU unit 2 fails and the data transmission line 5a is disconnected will be described. It is assumed that an abnormality that makes it difficult to execute the control operation has occurred in the B-system CPU unit 2 in the standby state. At this time, the self-diagnosis unit 20 in the B system CPU unit 2 detects an abnormality, the determination unit 22 determines that it is difficult to execute the control calculation, and the signal communication unit 21 transmits an abnormality occurrence signal to the A system CPU unit 14. At the same time, the data transmission / reception means 24a and 24b are instructed to stop data transmission / reception. In this state, if the data transmission line 5a is disconnected, the A-system input / output unit 3 detects that the self-diagnosis unit 31 has not received data from any of the data transmitting / receiving units 30a and 30b for a certain period of time and an abnormality occurs. Is transmitted to the automatic / manual switching means 33 and the control data output means 34. The automatic / manual switching means 33 receives the signal and switches to the manual mode. The control data output means 34 holds the value of the control data immediately before receiving the signal.

  Thereafter, the A-system input / output means 3 operates in the manual mode, and the control data can be increased or decreased according to the operation of the manual operation unit 8. For the B-system input / output means 4, the self-diagnosis means 10 in the A-system CPU unit 1 detects that the data transmission / reception means 14a has not received more than a predetermined time and determines that it is abnormal, and the determination means 12 performs control calculation. Judgment is difficult. Further, since it is detected through the signal communication means 11 that an abnormality has occurred in the B-system CPU unit 2, no switching signal is transmitted from the switching means 13, but data is transmitted to the data transmitting / receiving means 14a, 14b. Instruct to stop transmission / reception. Therefore, the diagnosis means 42 of the B-system input / output means 4 detects that there is no reception from any of the data transmission / reception means 40a and 40b for an arbitrary time and shifts to the manual mode.

  According to the control device of the first embodiment configured as described above, the control unit and the input / output unit are duplicated with respect to the control object, and a problem occurs in the duplicated control unit. In order to enable manual operation in some cases, it is easy to perform manual operation when the duplicated control units simultaneously fail (including control unit failure and control unit failure based on data transmission line) It can be carried out.

Embodiment 2. FIG.
In the first embodiment, since the A-system input / output means 3 and the B-system input / output means 4 are completely independent, the B-system CPU section 2 fails and the data transmission line 5a In the case of disconnection, both the A-system input / output means 3 and the B-system input / output means 4 are in the manual mode although the data transmission line 5b connecting the A-system CPU unit 1 and the B-system input / output means 4 is normal. I had to move on. Here, what can cope with such a case will be described. FIG. 3 is a block diagram showing the configuration of the control apparatus according to Embodiment 2 of the present invention, and FIG. 4 is a diagram showing a signal transmission state in communication means of the control apparatus shown in FIG. In the figure, the same parts as those in the first embodiment are denoted by the same reference numerals, and the description thereof is omitted. A communication means 35 and a second communication means 35 as a first communication means capable of monitoring the state of each other by inputting signals from the diagnosis means 31 and 42 to the A-system input / output means 3 and the B-system input / output means 4. Communication means 45 as communication means is provided. Further, the pulse diagnosis function 36, 46 is provided in each communication means 35, 45 by using the signal between the communication means 35, 45 as a pulse signal.

  Next, the operation of the control device of the second embodiment configured as described above will be described. However, when the manual operation unit is switched to the manual mode, and when both the A system CPU unit 1 and the B system CPU unit 2 are abnormally switched to the manual mode, the operations are the same as those in the first embodiment. The description thereof is omitted as appropriate. Here, a case where the B-system CPU unit 2 is broken and the data transmission line 5a is disconnected will be described, which is different from the first embodiment. First, the diagnosis unit 31 of the A-system input / output unit 3 detects that any control data is not transmitted from either of the data transmission / reception units 30a and 30b. Next, the A-system input / output means 3 receives via the communication means 35 that the B-system input / output means 4 is healthy (no failure has occurred) and the A-system CPU unit 1 is normal. In this state, the diagnostic unit 31 causes the control data output unit 34 to turn off the output of control data and transmits an abnormality occurrence signal to the B-system input / output unit 4 via the signal communication unit 35. Next, the B-system input / output means 4 detects that the A-system input / output means 3 has failed through the communication means 45, and sends the control data created by the A-system CPU unit 1 from the data transmission / reception means 4a. Receive and output to the plant equipment system 7 via the control data output means 44.

  Further, in order to detect that any signal line (data transmission line) is disconnected between the A-system input / output means 3 and the B-system input / output means 4, as shown in FIG. 3 and the B-system input / output means 4 are exchanged by pulse signals, and diagnosis is performed by pulse diagnosis functions 36 and 46. Thereby, it is possible to detect whether or not the signal line is disconnected. Details of the pulse diagnosis of the pulse diagnosis functions 36 and 46 will be described. First, an abnormality occurrence presence / absence signal 361 and a 2 KHz clock 364 (abnormal signal) and a 1 KHz clock 365 (abnormal signal) are input to the AND gates 366 and 367, respectively. If an abnormality has occurred, the AND gate 367 becomes significant, and a 1 KHz clock is input to the OR gate 368 and transmitted to the partner system.

  The counterpart system has similar pulse diagnosis functions 36 and 46, and the abnormality occurrence presence / absence signal transmitted from the counterpart system is input to the 2 kHz ± 20% bandpass filter 369 and 1 kHz ± 20% bandpass filter 372. If the signal transmitted from the partner system is 1 KHz (abnormal), the 1 KHz ± 20% bandpass filter 372 can pass but the 2 KHz ± 20% bandpass filter 369 cannot pass. Therefore, the clock detector 370 at the subsequent stage cannot detect the clock and outputs 0, but the clock detector 373 detects the clock and outputs 1. Accordingly, the partner system abnormality is detected. Further, when the signal line is disconnected, no pulse (clock) is transmitted, so that both the clock detectors 370 and 373 output 0. As a result, the disconnection of the signal line is detected, an alarm is issued, and an early failure location can be recovered.

  Since the control device of the second embodiment configured as described above judges the failure of the A-system input / output means and the B-system input / output means and outputs the control data from the normal input / output means, The operation in the automatic mode can be continued without changing the control state and the standby state. Furthermore, it is possible to determine which signal line is broken by using the pulse signal.

Embodiment 3 FIG.
In the second embodiment, the presence or absence of disconnection of the signal lines between the A system CPU unit 1 and the B system CPU unit 3 and the A system input / output unit 3 and the B system input / output unit 4 is determined. However, the present invention is not limited to this, and here, serial signals are used for communication of the communication means 35 and 45, and parity check functions 37 and 47 are provided, respectively. As a result, the disconnection of the signal line can be detected when the communication is interrupted for a certain time or more. Specifically, a counter is provided that increments by 1 when compared with the previous transmission when transmitting at regular intervals. Then, since the counter is not counted up for a certain period of time, the disconnection of the signal line can be detected.

  The control device according to the third embodiment configured as described above detects the disconnection of the signal line and issues an alarm, thereby enabling early recovery from the failure location. Also, when connecting the A-system input / output means and the B-system input / output means with a signal line, in the case of a pulse signal, an abnormality occurrence signal line, an output enable / disable signal line, an automatic / manual mode Although at least three signal lines are necessary, it is possible to send and receive signals through one signal line by communicating with a serial signal.

It is a block diagram which shows the structure of the control apparatus of Embodiment 1 of this invention. It is a figure which shows the structure of the manual operation part of the control apparatus shown in FIG. It is a block diagram which shows the structure of the control apparatus of Embodiment 2 of this invention. It is a figure for demonstrating the pulse diagnostic function in the control apparatus of Embodiment 2 shown in FIG. It is a block diagram which shows the structure of the control apparatus of Embodiment 3 of this invention.

Explanation of symbols

1 A system CPU section, 2 B system CPU section, 3 A system input / output means, 4 B system input / output means,
7 Plant equipment system, 8 Manual operation unit, 31, 41 Diagnosis means, 25, 45 Communication means.

Claims (3)

A duplicated first control for creating control data for controlling the control object in either the control state or the standby state, with one being in the control state and the other being in the standby state with respect to the control object And a second control unit, and a duplicated first that transmits an input signal from the control object to the first control unit or the second control unit and transmits the control data to the control object. In a control device comprising a plurality of input / output means and a second input / output means, a manual operation connected to the first input / output means and the second input / output means, respectively, for transmitting manual control data of the control object. And the first input / output unit and the second input / output unit receive both control data output from the first control unit and the second control unit, and the two control data are received at an arbitrary time. If not detected, the above manual operation Control apparatus characterized by comprising a first diagnosis means and a second diagnostic means for switching the manual operation in the. A first communication means and a second communication means for transmitting and receiving signals from the first diagnosis means and the second diagnosis means to each other; and the first diagnosis means and the second diagnosis means. The diagnostic means receives the both control data output from the first control section and the second control section, and the first communication means and the second communication if the both control data are not detected for an arbitrary time. 2. The control apparatus according to claim 1, wherein a failure of any one of the input / output means is determined based on a signal between the means, and the control data is transmitted to the control object from the normal input / output means. A signal between the first communication unit and the second communication unit is performed by a pulse signal or a serial signal, and the first input from the first control unit and the second control unit is performed by the pulse signal or the serial signal. 3. The control device according to claim 2, wherein disconnection of a signal line to the output means and the second input / output means is determined.

Images