JP7833436B2 - Pre-protection control device, anomaly detection and recovery method, protection control system - Google Patents

Description

This invention relates to power system protection and control technology, and more particularly to an anomaly detection method, system recovery method, and rollback method during anomaly recovery when a single system of a digital protection control device (Intelligent Electronic Device (IED)) is used to connect a higher-level device (Station Computer (SC), Gateway (GW)) and a lower-level device (Murging Unit (MU)).

Technological advancements in digital devices and communication technologies have enabled the installation of monitoring units (MUs) closer to the monitored equipment, and information is exchanged via process bus transmission to IEDs (Integrated Data Devices) installed in substation switchboard rooms. Furthermore, for monitoring and control purposes by maintenance personnel, communication between SCs (Service Centers) and GWs (Gateways) and IEDs is conducted via station bus transmission.

One of the advantages of digitalization is cost reduction through streamlined equipment, and this is one of the objectives of digitalization. However, to ensure system reliability, ultra-high voltage substations generally operate with a two-system configuration. An IED (Integrated Emergency Detector) is divided into a protective relay device for monitoring and eliminating system faults and a control device for monitoring substation conditions and operating equipment. If these were a single system, a degraded operation or system shutdown would be necessary in the event of an IED malfunction.

Japanese Patent Publication No. 2010-068594 (Patent Document 1) discloses a protection control system in which an IED is configured as a single system, and a backup IED and a database IED are installed. In the event of a malfunction in the protection control system, the database IED downloads information about the faulty IED and restores it as a replacement device for the malfunctioning IED.

Japanese Patent Publication No. 2010-068594

As described above, Patent Document 1 discloses a protection and control system that uses a single IED system with a backup IED and a database IED installed. However, the anomaly detection method and the response after recovery are not explicitly stated. In digital substations, numerous MUs and IEDs are connected, making the determination of anomaly detection methods complex. Furthermore, regarding the recovery method in the event of an anomaly, it is necessary to establish a mechanism that allows the backup IED to identify and recover the target IED, and to clarify the response of the backup IED when the target IED is recovered.

To solve at least one of the above problems, the present invention provides a backup protection control device connected to a plurality of merging units connected to at least one of an instrument for measuring a power system and equipment for controlling the power system, and a plurality of protection control devices that communicate with at least one of the merging units and have the function of performing calculations for the protection or control of the power system, wherein the backup protection control device comprises a processor and a memory, the memory holds a plurality of protection control programs for realizing the functions of each of the plurality of protection control devices, and the processor, when it detects an abnormality in any of the plurality of protection control devices, determines whether the protection control program for realizing the function of a protection control device other than the protection control device that detected the abnormality is being executed, and if the protection control program for realizing the function of a protection control device other than the protection control device that detected the abnormality is not being executed , it starts executing the protection control program for realizing the function of the protection control device that detected the abnormality, and when it receives a predetermined packet from the protection control device that detected the abnormality, it determines whether the protection control program for realizing the function of the protection control device that detected the abnormality is being executed, and if the protection control program for realizing the function of the protection control device that detected the abnormality is being executed, it terminates its execution .

According to one aspect of the present invention, it is possible to ensure system reliability and reduce costs by using a single system without requiring two separate systems for protective and control IEDs. This enables a configuration suitable for IEDs that do not require metal cables.

Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments.

This is a block diagram showing an example of the configuration of a digital substation system according to an embodiment of the present invention. This is a block diagram showing the internal configuration of a spare IED according to an embodiment of the present invention. This flowchart shows an example of the operation of a preliminary IED according to an embodiment of the present invention.

The following examples will be described with reference to the drawings.

Figure 1 is a block diagram showing an example of the configuration of a digital substation system 1 according to an embodiment of the present invention.

The circuit breakers (hereinafter referred to as CBs) and disconnectors (hereinafter referred to as LSs) 10 installed within the substation, as well as the instruments (PTs, CTs) 9 such as instrument transformers (hereinafter referred to as PTs) and instrument transformers (hereinafter referred to as CTs), are connected to MU8-1 to 8-L by metal wires. MU8-1 to 8-L digitize the status of the equipment and instruments in each section of the substation and send the data to the process bus 12. In the following description, MU8 may be used to refer to MU8-1 to 8-L as a whole or to each of them individually. The same applies to the protective IEDs 5-1 to 5-N and control IEDs 6-1 to 6-M described later.

The protective IEDs 5-1 to 5-N detect faults within the substation using protective relay calculations based on analog data obtained from the instrument 9. If a fault is detected, they send a shutdown command for the target equipment to the MU via the process bus 12. The MU 8 then shuts off the target CB via metal wires to suppress the spread of the fault.

The control IEDs 6-1 to 6-M convert the analog data obtained from the instrument 9 into the instrument's primary value and send it to the station bus 11 transmission. The control IEDs also send equipment status information to the station bus transmission. Control IED 6 receives equipment control commands from the gateway (GW) 5 and the direct operation PC (SC) 4 via the station bus transmission and sends control commands to the MU 8 connected to the target equipment via process bus transmission. The MU 8 then shuts off or turns on the target equipment via metal wire according to the command.

SC4 is a monitoring and control device for direct control when the GW (Gateway Wage) is not in use. When the GW is not in use, control is transferred from GW3 to SC4, enabling monitoring of measured values and equipment status within the substation from the control IED6 received via station bus transmission. It also allows for equipment operation for system shutdown due to equipment inspection, etc. GW3 is used for remote control and remote monitoring from the control center system 2 outside the substation, and its implemented functions are equivalent to those of SC4.

During normal operation, the backup IED 7 does not perform monitoring, control, or protective relay-related actions for this digital substation system 1. Instead, it monitors the transmission status between the protective IED 5, the control IED, and the MU 8. If any of the IEDs malfunction, it can switch to a replacement IED. Furthermore, once the cause of the malfunction in the malfunctioning IED is resolved, the backup IED 7 has completed its role as a replacement for the malfunctioning IED and can be returned to its original state.

Figure 2 is a block diagram showing the internal configuration of a spare IED 7 according to an embodiment of the present invention.

The backup IED 7 has a CPU 21, ROM 23, and RAM 24, which are connected via an internal bus 22. The ROM 23 inside the backup IED 7 stores compressed versions of all the programs shown in Figure 1: the protection program (for memory) 26 for the protective IED 5, the control program (for memory) 27 for the control IED 6, and the backup IED program (for memory) 25 for the backup IED 7.

In the example shown in Figure 2, the protection programs (for memory) 26 store the protection IED1 program to the protection IEDN program. These are compressed programs that allow the spare IED7 to operate as a replacement IED for protection IED5-1 to protection IED5-N. For example, they are compressed versions of programs equivalent to those that operate in protection IED5-1 to protection IED5-N.

Similarly, in the example shown in Figure 2, the control program (for memory) 27 stores the control IED1 program to the control IEDM program. These are compressed versions of programs that allow the spare IED7 to operate as a replacement IED for control IED6-1 to control IED6-M. For example, they are compressed versions of programs equivalent to those that operate in control IED6-1 to control IED6-M.

When the system is functioning normally, the backup IED program (operational) 28, obtained by decompressing the compressed file, is stored in RAM 24 and is loaded into the CPU 21 for operation. The backup IED program 28 is a simple program that does not affect the system.

Furthermore, the RAM 24 stores an anomaly/recovery detection program 30 so that the backup IED 7 can monitor the transmission status between each of the protective IED 5 and control IED 6 and the MU 8, and loads this program into the CPU 21.

For example, if the protective IED 5-1 malfunctions, the CPU 21 issues a command to the RAM 24 to decompress the protective IED 1 program (for memory) 26 stored in ROM 23 and overwrite the write area of the backup IED program 28 in RAM 24. After confirming that the protective IED 1 program (operation) 29, which was decompressed from the protective IED 1 program (for memory) 26, has overwritten RAM 24, the CPU 21 loads the protective IED 1 program 29 and then refreshes it.

Figure 3 is a flowchart showing an example of the operation of a backup IED 7 according to an embodiment of the present invention.

Figure 3 illustrates, as a specific example, the recovery response when the protective IED 1 malfunctions, as demonstrated by the anomaly/recovery detection program 30 implemented in the backup IED 7. The backup IED 7 constantly recognizes the transmission status between each protective IED 5, each control IED 6, and each MU 8 (step 31). For example, each MU 8 may transmit information to the backup IED 7 via process bus transmission indicating which protective IED 5 or control IED 6 it is transmitting and receiving with, and the backup IED 7 may recognize the transmitting and receiving partner of each IED based on this information.

Next, the backup IED 7 determines whether the protective IED 5-1 is connected to more than two devices (step 32). If the protective IED 5-1 is connected to two devices, it determines whether both of those devices are malfunctioning (step 34). The purpose of this is that when the IED is transmitting and receiving from two devices, malfunction information from only one device is insufficient to definitively determine that the IED is malfunctioning. Therefore, the backup IED 5-1 is only determined to be malfunctioning if malfunction information is received from both devices. The reason for using an AND condition of two devices is to prevent the backup IED 7 from mistakenly determining that the protective IED 5-1 is malfunctioning if the MU connected to the protective IED 5-1 experiences a CPU failure or malfunction.

Furthermore, if the protective IED 5-1 is connected to more than two devices, the backup IED 7 performs a majority vote and determines that the IED is faulty if the number of fault detections is equal to or greater than the number of normal detections (step 33). In this majority vote, if the number of fault detections and normal detections are equal, the number of fault detections takes precedence, and the IED is determined to be faulty.

Furthermore, the backup IED 7 may monitor packets transmitted and received via, for example, the process bus 12, and detect transmission anomalies with an IED if an IED does not respond to packets from MU8. For example, if in step 31 it is recognized that the transmission partner of MU8-1 is the protective IED 5-1, and packets are transmitted from MU8-1 to protective IED 5-1, but packets are not transmitted from protective IED 5-1 to MU8-1, the backup IED 7 may detect a transmission anomaly between MU8-1 and protective IED 5-1. Alternatively, in such a case, MU8-1 may notify the backup IED 7 of the transmission anomaly with protective IED 5-1, and based on this, the backup IED 7 may detect a transmission anomaly between MU8-1 and protective IED 5-1.

In the example shown in Figure 3, the protective IED 5-1 transmits and receives data from two devices, MU8-1 and MU8-2. In this case, the backup IED 7, upon receiving abnormal information from both devices, determines that the protective IED 1 is abnormal and verifies that the backup IED 7's current program is the backup IED program 28 (step 35). The purpose of this is that if another program is already loaded, the program rewriting process cannot be performed; in this case, the process is terminated (step 37).

If the digital substation system 1 includes only one backup IED7, then only one IED will be available for replacement. However, as an enhanced feature, when multiple backup IED7s are installed and operated, a priority order can be set for the backup IED7s. This allows for the replacement of faulty IEDs in order from the backup IED7 with the lowest priority.

In step 37, if it is confirmed that the currently loaded program is the backup IED program 28, the backup IED 7 decompresses the protective IED 1 program 26 recorded in ROM 23, rewrites the decompressed protective IED 1 program 29 to RAM 24, loads it to CPU 21 after the rewriting is complete, and performs a CPU refresh after the loading is complete (step 36).

After the refresh, if the CPU 21 runs normally, the backup IED 7 connects to the MU 8 on the process bus transmission side and to the SC 4 and GW 3 on the station bus transmission side. This allows the backup IED 7 to replace the protective IED 5-1, and the digital substation system 1 is restored.

In the case of a malfunctioning protective IED 5-1, after a period of time, maintenance personnel will visit the substation and restore the IED by replacing the circuit board that was the cause of the malfunction. During the restoration operation, the power to the protective IED 5-1 is temporarily cut off and then restored. This starts the CPU (not shown) of the protective IED 5-1. After startup is complete, the protective IED 5-1 sends an initial packet (i.e., the first packet at the start of normal CPU processing) via program bus transmission to each MU8 and the backup IED 7. The backup IED 7 receives this initial packet via process bus transmission (step 38).

Upon receiving the initial packet, the backup IED7 verifies that its current program is the protective IED1 program 29 (step 39).

If the current program is the protective IED1 program 29, the backup IED7 disconnects from the MU8, decompresses the backup IED program 25 stored in the ROM 23, and rewrites the decompressed backup IED program 28 to the RAM 24. After the rewriting to the backup IED program 28 is complete, it is loaded to the CPU, and after loading is complete, a CPU refresh is performed (step 40). This terminates the execution of the protective IED1 program 29, and as a result, the backup IED7's operation of substituting for the protective IED5-1 ends.

After refreshing, if the CPU 21 of the backup IED 7 performs a normal run, the backup IED 7 will not perform the monitoring and control or protective relay behavior of the digital substation system 1 as before, but will instead monitor the transmission status between the protective IED 5, the control IED 6, and the MU 8.

Furthermore, after the backup IED7 loses transmission with MU8, the protective IED5-1, which has been restored, connects to MU8 on the process bus transmission side and to SC4 and GW3 on the station bus transmission side, thereby restoring the system.

Furthermore, the system of the embodiment of the present invention may be configured as follows:

(1) A backup protection control device (e.g., backup IED 7) is connected to a plurality of merging units (e.g., MU 8) and a plurality of protection control devices (e.g., protection IED 5 and control IED 6), each of which merging units is connected to at least one of an instrument for measuring the power system (e.g., instrument 9) and equipment for controlling the power system (e.g., equipment 10), each of which protection control devices communicates with at least one of the merging units and has the function of performing calculations for the protection or control of the power system, and the backup protection control device has a processor (e.g., CPU 21) and memory (e.g., ROM 23 and RAM 24), and the memory is connected to the plurality of protection control The device maintains multiple protection control programs (e.g., a protection IED program 26 and a control IED program 27) for implementing each of its functions. When the processor detects an abnormality in any of the multiple protection control devices, it determines whether the protection control program for implementing the functions of the protection control devices other than the one that detected the abnormality is being executed (e.g., step 35). If the protection control program for implementing the functions of the protection control devices other than the one that detected the abnormality is not being executed, the processor starts executing the protection control program for implementing the functions of the protection control device that detected the abnormality (e.g., step 36).

This allows for system reliability to be ensured and costs reduced by providing one or a few spare IEDs for multiple protective IEDs and multiple control IEDs, without requiring two separate systems for protective and control IEDs.

(2) In the auxiliary protection control device described in (1) above, when the processor receives a predetermined packet (e.g., an initial packet) from the protection control device that detected the anomaly, it determines whether the protection control program for realizing the function of the protection control device that detected the anomaly is being executed (e.g., step 39), and if the protection control program for realizing the function of the protection control device that detected the anomaly is being executed, it terminates its execution (e.g., step 40).

This allows for a rollback when a malfunctioning protective or control IED is restored.

(3) The auxiliary protection control device described in (2) above, wherein the processor detects the transmission status between each of the plurality of protection control devices and the plurality of merging units, and detects an abnormality in each of the plurality of protection control devices based on the transmission status (for example, steps 33 and 34).

This allows for the proper detection of abnormalities in the protective control system.

(4) The auxiliary protection control device described in (3) above, wherein the processor identifies the merging units that are the transmitting and receiving partners for each of the plurality of protection control devices (for example, step 31), and for a protection control device in which two of the plurality of protection control devices have been identified as transmitting and receiving partners, if an abnormality is detected in the transmission with either of the two identified merging units, the processor detects an abnormality in the protection control device (for example, steps 32, 34), and for a protection control device in which three or more of the plurality of protection control devices have been identified as transmitting and receiving partners, if an abnormality is detected in the transmission with more than half of the three or more identified merging units, the processor detects an abnormality in the protection control device (for example, steps 32, 33).

This allows for the proper detection of abnormalities in the protective control system.

(5) The auxiliary protection control device described in (3) above, wherein the auxiliary protection control device is connected to the plurality of merging units and the plurality of protection control devices via a bus (e.g., process bus 12), and the processor monitors packets transmitted and received via the bus, and detects an abnormality in transmission between the merging unit and the protection control device if the protection control device does not respond to a packet transmitted from the merging unit.

This allows for the proper detection of abnormalities in the protective control system.

Furthermore, the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are explained in detail for a better understanding of the present invention, and are not necessarily limited to those having all of the described configurations. Also, it is possible to replace parts of the configuration of one embodiment with those of another embodiment, and to add configurations from other embodiments to the configuration of one embodiment. In addition, it is possible to add, delete, or replace parts of the configuration of each embodiment with those of other embodiments.

Furthermore, each of the above-described configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above-described configurations and functions may be implemented in software by a processor interpreting and executing programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in storage devices such as non-volatile semiconductor memory, hard disk drives, SSDs (Solid State Drives), or computer-readable non-temporary data storage media such as IC cards, SD cards, and DVDs.

Furthermore, the control and information lines shown are those deemed necessary for explanation purposes and do not necessarily represent all control and information lines in the actual product. In practice, it can be assumed that almost all components are interconnected.

1. Digital substation system 2. Remote control system 3. Gateway (GW)
4. Direct Operation PC (SC)
5-1~N…Protection IED
6-1 to M... Control IED
7. Spare IED
8-1~L...MU
9... Instrument (PT, CT)
10...Equipment (CB, LS)
11... Station bus 12... Process bus 21... CPU
22...Internal bus 23...ROM
24...RAM
25... Backup IED program (for memory)
26...Protection program (for memory)
27... Control program (for memory)
28. Backup IED Program (Operation)
29...Protective IED1 program (operation)
30... Anomaly/Recovery Detection Program

Claims (9)

A backup protection control device connected to a plurality of merging units connected to at least one of an instrument for measuring a power system and equipment for controlling the power system, and a plurality of protection control devices having the function of communicating with at least one of the merging units and performing calculations for the protection or control of the power system ,
The aforementioned pre-protection control device has a processor and memory,
The memory holds multiple protection control programs for realizing the functions of each of the multiple protection control devices,
The aforementioned processor,
If an abnormality is detected in any of the above-mentioned multiple protection control devices, it is determined whether the protection control program for implementing the functions of the protection control devices other than the protection control device that detected the abnormality is being executed.
If the protection control program for realizing the functions of a protection control device other than the protection control device that detected the abnormality is not being executed, the execution of the protection control program for realizing the functions of the protection control device that detected the abnormality will be started .
When a predetermined packet is received from the protection control device that detected the anomaly, it is determined whether the protection control program for realizing the function of the protection control device that detected the anomaly is being executed.
A backup protection control device characterized in that, if the protection control program for realizing the function of the protection control device that detected the aforementioned abnormality is being executed, the execution of the program is terminated . A preliminary protection control device according to claim 1,
The processor is characterized by detecting the transmission state between each of the plurality of protection control devices and the plurality of merging units, and detecting an abnormality in each of the plurality of protection control devices based on the transmission state. A preliminary protection control device according to claim 2,
The aforementioned processor,
Identify the merging unit that is the transmitting and receiving partner for each of the plurality of protection control devices,
In the case of a protection control device among the plurality of protection control devices in which two merging units have been identified as the transmitting and receiving partners, if an abnormality is detected in the transmission with either of the two identified merging units, the protection control device will be detected as having an abnormality.
A backup protection control device is characterized in that, among the plurality of protection control devices, if a protection control device for which three or more merging units have been identified as the transmitting and receiving partners detects an abnormality in transmission with more than half of the three or more identified merging units, the backup protection control device detects an abnormality in the said protection control device. A preliminary protection control device according to claim 2,
The aforementioned auxiliary protection control device is connected to the plurality of merging units and the plurality of protection control devices via a bus.
The backup protection control device is characterized in that the processor monitors packets transmitted and received via the bus, and detects an abnormality in transmission between the merging unit and the protection control device if the protection control device does not respond to packets transmitted from the merging unit. An anomaly detection and recovery method using a backup protection control device connected to a plurality of merging units connected to at least one of an instrument for measuring a power system and equipment for controlling the power system, and a plurality of protection control devices having the function of communicating with at least one of the merging units and performing calculations for the protection or control of the power system,
The aforementioned pre-protection control device has a processor and memory,
The memory holds multiple protection control programs for realizing the functions of each of the multiple protection control devices,
The aforementioned anomaly detection and recovery method is:
If the processor detects an abnormality in any of the plurality of protection control devices, the first step is to determine whether the protection control program for implementing the functions of the protection control devices other than the protection control device that detected the abnormality is being executed.
If the protection control program for realizing the functions of a protection control device other than the protection control device that detected the abnormality is not being executed, the processor starts executing the protection control program for realizing the functions of the protection control device that detected the abnormality, in a second step.
A third step in which, when the processor receives a predetermined packet from the protection control device that detected the anomaly, it determines whether the protection control program for realizing the function of the protection control device that detected the anomaly is being executed.
An anomaly detection and recovery method, characterized by comprising: a fourth step of terminating the execution of the protection control program if it is running to implement the function of the protection control device that has detected the anomaly. An anomaly detection and recovery method according to claim 5,
An anomaly detection and recovery method characterized in that, in the first step, the processor detects the transmission state between each of the plurality of protection control devices and the plurality of merging units, and detects an anomaly in each of the plurality of protection control devices based on the transmission state. An anomaly detection and recovery method according to claim 6,
In the first step, the processor,
Identify the merging unit that is the transmitting and receiving partner for each of the plurality of protection control devices,
In the case of a protection control device among the plurality of protection control devices in which two merging units have been identified as the transmitting and receiving partners, if an abnormality is detected in the transmission with either of the two identified merging units, the protection control device will be detected as having an abnormality.
An abnormality detection and recovery method characterized in that, among the plurality of protection control devices, if an abnormality is detected in transmission with more than half of the three or more specified merging units, an abnormality of the protection control device is detected. An anomaly detection and recovery method according to claim 6,
The aforementioned auxiliary protection control device is connected to the plurality of merging units and the plurality of protection control devices via a bus.
An anomaly detection and recovery method characterized in that, in the first step, the processor monitors packets transmitted and received via the bus, and if the protection control device does not respond to a packet transmitted from the merging unit, it detects an anomaly in the transmission between the merging unit and the protection control device. A protective control system,
The system comprises: a plurality of merging units connected to at least one of an instrument for measuring the power system and equipment for controlling the power system; a plurality of protection control devices having the function of communicating with at least one of the merging units and performing calculations for the protection or control of the power system; and one or more auxiliary protection control devices connected to the plurality of merging units and the plurality of protection control devices.
The number of the aforementioned auxiliary protection control devices is less than the number of the aforementioned protection control devices.
The aforementioned pre-protection control device has a processor and memory,
The memory holds multiple protection control programs for realizing the functions of each of the multiple protection control devices,
The aforementioned processor,
If an abnormality is detected in any of the above-mentioned multiple protection control devices, it is determined whether the protection control program for implementing the functions of the protection control devices other than the protection control device that detected the abnormality is being executed.
If the protection control program for realizing the functions of a protection control device other than the protection control device that detected the abnormality is not being executed, the execution of the protection control program for realizing the functions of the protection control device that detected the abnormality will be started.
When a predetermined packet is received from the protection control device that detected the anomaly, it is determined whether the protection control program for realizing the function of the protection control device that detected the anomaly is being executed.
A protection control system characterized in that, when the protection control program for realizing the function of the protection control device that detected the aforementioned abnormality is being executed, the execution of the protection control program is terminated.