JPH0760322B2 - Plant control equipment - Google Patents

Description

Description: BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a plant control device, and more particularly, to a drive control module (DCM) of a controller that integrally controls a plurality of devices.

[Background of the Invention]

Conventional sequence control devices consisted of wire logic with relays or solid state,
When the system is sophisticated and complicated due to the wide-ranging automation to enable the plant operation by a small number of people and the increase in the number of plant auxiliary equipment due to the increase in the coal-fired power plant accompanying the fuel conversion, etc. The quantity and the number of wires will be enormous. Further, since the conventional hard-wired logic controller is not sufficient to meet advanced needs such as sequence progress display, traffic jam display, abnormality diagnosis, etc., sequence controller using digital controller has become popular. .

However, because of the economic reason, the digital controller is inevitably configured to process multiple auxiliary machines in a time-sharing manner by one controller, so when a CPU failure occurs, it is impossible to control multiple auxiliary machines and it is important to continue plant operation. This will cause a failure. Therefore, it is necessary to multiplex the controllers. In addition, an interlock (hereinafter referred to as an auxiliary machine protection interlock) that forcibly stops the auxiliary machine to ensure its safety is required in a situation in which the auxiliary machine is damaged when the auxiliary machine is continuously operated. However, even if a conventional digital controller is used, it is configured by a hard wire logic. This is because the accessory protection logic must always be operating while the accessory is operating regardless of whether the CPU is operating or not, and the failure of the accessory protection logic directly leads to a serious accident such as damage to the accessory. Is.

FIG. 2 shows the configuration of a control device using a conventional digital controller. 1 is a digital controller and 2
CPU, 3a-3n digital input card (hereafter DI card), 4a-4n digital output card (hereafter DO card)
And the PI / O bus 7. 8 is an auxiliary equipment protection circuit, an alarm circuit, and a manual operation circuit, which manually controls the operation end when a digital controller malfunctions by a command from the manual operation switch shown in 9 and a process status signal from the plant 10. In such a situation that the operation of the plant can be continued and the plant is damaged, the auxiliary machinery is forcibly stopped to ensure the safety of the plant. 11
Is a device, and a plant is composed of a plurality of devices. Here, mainly for economic reasons, generally, one digital controller 1 controls a plurality of devices 11.

FIG. 3 shows the control device using the digital controller shown in FIG. 2 in more detail. Reference numeral 20 is a circuit executed by software stored in the memory in the CPU 2 in FIG.

These circuits are described by the macro language shown in 21,22,23. 21 is a logical sum macro, 22 is a logical product macro, and 23 is a logical negation macro. 26 is a sequential control logic, the sequential control command 24, the sequential stop command 25, and the process state signals 27a to 27n are used to describe the sequential control processing contents in a macro language, which is predetermined while confirming the process state. Automatic start command 28a to 28n, automatic stop command to each device in order
29a to 29n are output from DO.

Reference numeral 80 designates one auxiliary equipment protection circuit, alarm circuit and manual operation circuit shown in FIG. 2, and its logic circuit is constituted by a hard wire logic. When the automatic mode is selected by the 92 automatic / manual switching switch, the command from the manual operation switch 91, 93 is locked by the 81 AND circuit and the automatic operation output 28a, 29a from the digital controller is selected. Process status signal 85
After confirming, the operation end 12 is automatically operated. On the other hand, when the manual mode is selected, the manual operation is performed while confirming the process state signal 85 according to the operation of the manual operation switches 91 and 93. Further, the protection interlock 87, when detecting a serious abnormal state of the equipment at the detection ends 14 and 15, determines the abnormal state by taking in the abnormal state signals 86a to 86n, and it is determined by any operation command. The highest priority is to forcefully output a stop command to ensure device safety.

FIG. 4 shows a front view and a side view of a conventional sequence controller using a digital controller. Reference numeral 100 is a system cabinet of the control device, 101 is a control power supply device, 1 is a digital controller, 102 is an input / output cable of the digital controller, 8 is auxiliary equipment protection, alarm, manual operation circuit composed of 103 electromagnetic relays, etc. Is. 104 is wiring for combining electromagnetic relays to form a circuit,
105 is an external terminal block and 106 is an external cable that is connected to the plant.

As described above, in the conventional system, in order to eliminate the problem that multiple devices cannot be operated when the digital controller fails, auxiliary equipment protection circuit is equipped with hardware of the same scale as the digital controller and a huge number of wirings. However, unless the alarm circuit and the manual operation circuit are configured, it is impossible to configure a sequence control device that requires continuous operation even when the digital controller fails, as in a power plant.

A known example of such a conventional system is described in the Journal of the Institute of Electrical Engineers of Japan, October 1981, Vol. 101, No. 10, "Full automation of thermal power plants-its trend and prospects", P15 and Fig. 2.

[Object of the Invention]

An object of the present invention is to provide a protective operation even when a CPU of a digital controller is faulty and to perform a manual operation without providing a complicated auxiliary equipment interlock and a manual operation circuit by a hard wire logic, and to operate a plant. A function PI / O that has the required number of input / output points and can be maintained independently, in a one-to-one correspondence with the equipment to be configured.
It is to provide a highly reliable and simple sequence control device configured thereby.

[Outline of Invention]

The present invention, in a plant control device for controlling the operation of a plurality of equipment constituting the plant or a predetermined part thereof,
It is characterized in that it is configured as follows.

That is, a CPU that calculates a control command signal required for each device to control multiple devices in general, and a plurality of DCMs that are independently provided between the CPU and the plurality of devices for each of the plurality of devices. And a PI / O bus that forms a signal transmission line between the CPU and a plurality of DCMs, and the DCM is output to a plurality of input signals including process signals of the device and the operating end of the device. It is characterized by having an input / output unit for inputting and outputting a plurality of output signals including the control command signal, and a backup unit for backing up the control and / or substitution of the control by the CPU.

This backup is characterized in that it is performed based on an operating end state signal (for example, "infeedback" or "off" feedback) indicating an operating state of the device in accordance with an output signal to the operating end.

According to the present invention, since the DCM is thus configured on a device-by-device basis, the input / output means and the backup means can be modularized on a single board, and the backup means can be multi-functionalized, and a large number of DCMs can be installed. Achieve required downsizing of large-scale plant control equipment. In addition, maintenance is facilitated by providing a DCM for each device.

Since the backup means according to the present invention is configured to output the display signal corresponding to the received operation end state signal to the external display device via the output means, the device control state can be constantly monitored. . Further, the backup means has means for detecting an abnormality of the CPU, and is configured to prohibit the output of the operation command signal from the CPU to the operation end when the operation of the CPU is abnormal. There is.

In this way, when the CPU is abnormal, the DCM will stop erroneously controlling the CPU and perform scheduled interlock or switch to manual operation to improve system reliability.

Further, according to the present invention, since the backup means has the manual mode setting means, the operation by the manual setting can be performed for each device without depending on the CPU, and the test and the response to the abnormality of the CPU become easy.

Example of Invention

 An embodiment of the present invention will be described below with reference to FIG.

FIG. 1 is an example of the configuration of a sequence control system. In the figure, 11a to 11n are respective devices, 150a to 150n are device groups including a plurality of devices 11, 151a to 151n are systems including a plurality of device groups 150, and 152 is a multiple system 15
It is a power plant consisting of 1. Reference numerals 153a to 153n are one print card corresponding to the equipments 11a to 11n of the plant in a one-to-one manner, and are DCMs capable of covering the input / output required for controlling the corresponding equipments. Reference numeral 154 is a CPU that integrally controls a plurality of DCMs 153a to 153n, 155 is its PI / O bus, and 156a to 156n are device group controllers. Reference numeral 157 is a system controller that integrally controls a plurality of device group controllers 156a to 156n. Reference numeral 158 is an in-system serial signal transmission line that connects the system controller 157 and a plurality of device group controllers 156a to 156n. 159a to 159n are system-based control systems, and 160 is a plurality of system-based control systems 1
It is a master controller that centrally controls 59a to 159n. 1
Reference numeral 61 is a system serial transmission line connecting the master controller and a plurality of system controllers.

FIG. 5 shows the details of DCM. 200 is a circuit executed by software stored in the memory in the CPU. 201 is a hardware circuit realized by one printed circuit board of DCM. 202 is a PI / O bus,
The DCM card is interfaced via the PI / O bus 202. Within the 200, there are circuits 203 to 206, and the control functions of the circuits are described in a macro language. The 203 sequence automatic operation interlock outputs the operation command to each operation end in the system while checking the state of the operation end when the automatic mode is selected. The operation permission interlock 204 determines from the input process state signal whether the operating end is operable. The automatic operation interlock 205 based on the external process condition determines whether or not the operating end is in an automatically operable state based on the input process state signal, and outputs an operation command if the automatic operation is possible. The operating-end diagnosis circuit 206 is for inputting an operation command to the operating end and a status signal of the operating end to determine whether the operating end is erroneous or inoperative, and outputs an abnormal signal when there is an abnormality.

In the 201 DCM card consisting of one printed circuit board,
250 DI section 16 points, 251, DO section 6 points, 252 basic logic, 2
Built-in 53 protection logic and 254 logic pattern selector. The usage of each channel of DI and DO is as shown in the figure. The basic logic of 252 is a fixed logic of the minimum necessary logic common to each operating end among the operating circuit and the status display circuit of the operating end.
able array logic). The protection logic 253 is a logic for preventing equipment damage and the like due to malfunctions and malfunctions, and is composed of a ROM (Read Only Memory).

Reference numeral 300 denotes an operator's operation unit including a switch for manual operation and a lamp for displaying a status. Reference numeral 12 is a motor for driving the operating end 13, and 16 is a metakura and a power center, which are composed of a power supply for supplying power to the driving motor 12, a breaker, a breaker, and a control circuit for the breaker. Reference numeral 14 is a switch for detecting pressure and flow rate, and 15 is a limit switch for detecting the state and position of the equipment.

FIG. 6 shows the details of the protection logic 253 in FIG. Four
The address bus 402 of the storage device 03 is used as an input unit to input signals such as a logic pattern selection unit 254, a contact input signal 408, a storage input signal 406, and a timer signal 407. The storage device 403 configures a logic pattern according to these input conditions, and outputs the result as a data bus 404 as an output unit. A part of the signal output via the data bus 404 is input as a storage input signal 406, and a part of the signal is input again to the address bus 402 via the timer 405, and constitutes a hold circuit and a time-delay operation circuit, respectively. By selecting the required logic with the logic pattern selection unit 254 with the above configuration, the logic circuit corresponding to the contact input signal 408 is configured in the storage device 403, and the storage input signal 40 is input as necessary.
6. A desired output 409 is obtained by adding the timer signal 407.
In FIG. 6, the logic pattern selection unit 254 is represented by 6 bits, but in this case, 2 ⁶ = 64 patterns of logic can be selected. This bit number should be selected as necessary,
For example, if 256 patterns of logic are required, 8 bits may be used. Input signal 408, memory input signal 406, timer input
407 can also change its score within the range of the input score of the storage device 403 as required. Although the storage device 403 is a ROM in FIG. 5, it is a RAM (Random Access Memor).
y), core memory, etc. can be used, and the logic to be configured can be fixed in ROM or the like, or can be configured to be changeable in RAM, core memory, or the like.

The logic configured as described above is installed on a printed board as shown in FIG. 5, and a state signal that damages equipment such as a decrease in bearing hydraulic pressure of a motor is input by a contact input 408. Thus, the logic pattern selecting section 254 selectively configures a protection interlock that outputs an output 409 for forcibly stopping the device when necessary. As a result, since the protection interlock does not pass through the CPU, it operates reliably even in the case of a CPU failure, and the safety of the device is ensured, so that a highly reliable and flexible protection circuit is configured.

FIG. 7 shows a specific method of creating the logic described in FIG. In the example of FIG. 7, for simplicity, the logic pattern selection unit 254 has 3 bits, the input 408 has 2 points, and the timer 405 has 2 points. An example of the logic pattern configured by this input is shown in the lower left frame, and the pattern number is 010. The time chart by this logic is shown in the lower right. When the external input A is turned ON, the wire number 414 causes the timer T1 to start timer mounting. When the external input B is turned ON, the timer T2 similarly starts counting by the wire number 413. External input B is
When A is turned on, A is also turned on, so the output C is output as an ON state via the wire numbers 415 and 411. When the timer T1 completes counting, the output D is output in the ON state via the wire number 412. A method of configuring this logic on the memory will be described below. Two memory addresses and two external inputs
It is assumed that it is made up of a total of 7 bits including points and logic pattern selection section, and these are treated as parameters for instructing memory addresses in order. If the selection pattern of the logic pattern selection unit 254 is 010, the address area in which the upper 3 digits of the address corresponding to the switch selection unit is 010 is selected. At this time, the corresponding address is selected according to the ON / OFF state of the two points of the external input 408. Output section 411,41 according to this address
2,413,414 are programmed according to the logic pattern, and are output corresponding to this program. Output part 413,
When 414 turns on, timer 405 starts counting,
Depending on whether this timer has completed counting, the storage unit
It is input to 403, the memory address corresponding to this is further accessed, and as a result, it is output from the output units 411 and 412 according to these input states. The output section may be any number within the range of the data bit of the memory.

FIG. 8 shows the details of 252 basic logics in FIG. Four
Reference numeral 20 is a status display logic, and 450 is an operation command logic. The uses of input / output signals are as shown in Fig. 8. The signals in the dotted line frame are the input signals from the CPU, the signals in the solid line frame are the input signals from the protection logic ROM, and the signals without the frame are the external input / output signals. Show. Reference numeral 441 is an “ON” lamp lighting command output signal, which is the output of the logical sum 437. The logical sum 437 outputs the "ON" lamp lighting command of 441 when either of the logical products 433, 435 and the lamp test signal 424 is established. Therefore, if the control power supply normal signal 427 is ON and the CPU is in the RUN state, the CPU
In accordance with the "ON" lamp lighting signal 422 from the ON lamp, a lighting command 441 is output to the "ON" lamp, and in the CPU stop state, the signal 422 from the CPU is locked by the logical product 433 and also according to the "ON" feedback signal from the process. Then, the lighting command 441 is output. Further, the 442 “off” lamp lighting command output signal is also configured by the same logic. "Automatic" lamp lighting command output signal 443 and "manual" lamp lighting command output signal 444 are ON / OFF of automatic / manual mode selection switch
Directly output by the status signal 428. As described above, the process status display and operation mode display necessary for manual operation are
When the CPU is stopped, it is captured from the DI channel within the DCM card without going through the CPU, and is output directly to the DO channel via the status display logic 420, so the display is secured even when the CPU fails.

The “input” command output signal of 485 is output with the highest priority when the protection “input” signal 451 which is an abnormal state signal requiring auxiliary equipment protection is input by the logical sum 483. Further, in the normal operation, not in such an abnormal state, the "ON" prohibition signal 452 which is an input from the ROM is not established, and the "ON" permission signal which is an input from the CPU is established. After confirming that with the logical product 481, the "ON" command output signal is output according to the "ON" command 456 from the CPU when the automatic mode is selected, and according to the operation signal 457 by the operation switch when the manual mode is selected. During the CPU stop, the "ON" permission signal 453 from the CPU is bypassed by the CPU stop state signal 458 and the logical sum 477, so that the manual operation and the protection interlock are protected regardless of the operating state of the CPU.

FIG. 9 shows the protection logic 403 in FIG. 6 and the protection logic 4 in FIG.
Shows connections to 20 and 450 basic logics. It should be noted that this figure is also a detailed view of the hardware circuit realized by one DCM printed circuit board 201 shown in FIG. The protection logic 403, the basic logics 420 and 450, the DI unit 250, the DO unit 251, and the PI / O bus 202 are connected as shown by mode wiring on the printed board. In the protection logic 403, the process status signal for configuring the protection interlock and the permission condition, etc. is inputted through the DI section 250, and the forced operation command which is the output from the protection logic is matched at the logical sum gate. Later, it is entered into 450 basic logics. In the basic logic 450, the forced operation command from the protection logic 403 is output from the DO unit 251 with the highest priority over any of the manual operation command and the automatic operation command from the CPU. In addition, the operation command from the manual operation switch 300 and the device status feedback signal are both 450, 42 directly from the DI unit 250 without going through the CPU.
It is input to the basic logic of 0, and after performing a predetermined logical operation, is output from the DO unit 251 to the indicator lamp 300 and the operating end. On the other hand, all external signals input from the DI section 251 are PI / O bus 202
It is input to the CPU via the CPU and performs complicated arithmetic processing such as sequential automatic operation interlock and operating end abnormality diagnosis circuit, and the result is sent to the basic logic 4 via the PI / O bus 202.
Output to 20,450. The basic logic 450 outputs an operation command from the CPU after confirming the operation mode and the operation permission condition.

FIG. 10 shows a mounting diagram of the system cabinet of the control device according to the present invention. 600 is a system cabinet, 601 is a digital controller, 602 is a controller input / output cable, 605 is an external terminal block, and 606 is an external cable. In this way, the digital controller input / output can be directly connected to an external process without the protection and manual operation circuit composed of relays, etc., so it is possible to construct a very simple and highly reliable system. Become. In addition, the DCM card is a printed circuit board corresponding to each process equipment as shown in the figure.
Since maintenance such as replacement independent of the DCM can be performed, it is possible to build a highly autonomous control device.

〔The invention's effect〕

According to the present invention, the input / output function of the number of input / output points and the protection interlock at the time of a CPU failure corresponding to one unit, which is a single small unit that constitutes the system unit distributed control system for the power plant, Independent of each DCM card by realizing the manual operation function as a DCM built into one printed circuit board, arranging it in each device, and controlling these DCM cards centrally by the CPU of the device group controller. Therefore, it is possible to perform maintenance, and it is possible to construct a highly reliable system without providing a protective interlock and a manual operation circuit formed of a relay or the like outside the digital controller.

[Brief description of drawings]

FIG. 1 is an embodiment of the present invention (system configuration), FIGS. 2 and 3 are explanatory views of a conventional technique, FIG. 4 is a cabinet mounting diagram of a conventional system, and FIG. 5 is a DCM card explanatory diagram of the present invention. ,
6 and 7 are block diagrams and explanatory diagrams of a protection logic unit in the DCM card, FIG. 8 is a configuration diagram of a basic logic unit in the DCM card, FIG. 9 is a hardware configuration diagram of the DCM card, and FIG.
The figure is a system cabinet mounting diagram of the present invention. 1 ... Digital controller, 8 ... Protection circuit, alarm circuit and manual operation circuit, 11 ... Equipment, 153 ... DCM (Driv
e Control Module), 156 …… Device group controller, 157 …… System controller, 252 …… Basic logic,
253 …… Protection logic.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Teruo Murao Inventor Teruo Murata 3-2-1 Hitachi City, Ibaraki Prefecture Inside Hitachi Engineering Co., Ltd. (72) Inventor Toshiro Hosogai 3-2 Saiwaicho, Hitachi City, Ibaraki Prefecture No. 1 in Hitachi Engineering Co., Ltd. (56) References "Instrumentation control system" edited by Yasushi Ishii Denki Shoin

Claims (7)

[Claims] 1. A plant control device for controlling the operation of a plurality of equipments forming a plant or a predetermined part of the plant, which centrally calculates a control command signal necessary for each equipment to integrally control the plurality of equipments. A processing device (hereinafter, referred to as CPU), a plurality of drive control modules (hereinafter, referred to as DCM) provided between the CPU and the plurality of devices and corresponding to each of the plurality of devices independently of each other; PI that forms a signal transmission path between the CPU and the plurality of DCMs
And an input / output unit for inputting and outputting a plurality of input signals including a process signal of the device and a plurality of output signals including the control command signal output to the operation end of the device. ,
A plant control device comprising a backup means for performing a backup for monitoring and / or substitution of control by the CPU. 2. The backup means according to claim 1, wherein the backup means backs up based on an operating end state signal indicating an operating state of the device in response to an output signal to the operating end. Plant control equipment. 3. The plant control device according to claim 1 or 2, wherein the DCM is formed on an individual substrate and is replaceable independently of other DCMs. 4. The backup means according to any one of claims 1 to 3, wherein the backup means receives the display signal corresponding to the operation end state signal from the outside via the input / output means. A plant control device configured to output to a display device. 5. The backup means according to any one of claims 1 to 4, wherein the backup means has means for detecting an abnormality of the CPU, and the operation is performed when the abnormality of the CPU is detected. A plant control device configured to prohibit the output of a command signal to the operating end. 6. The backup command means according to any one of claims 1 to 3, wherein the backup means has a manual mode setting means, and when a manual mode is set, an operation command signal from the CPU. In place of the above, the plant control device is configured to output a predetermined manual operation command signal input from the outside to the operation end. 7. The input / output unit according to claim 6, wherein the backup unit outputs a display signal corresponding to the operation end state signal when the manual operation instruction signal is output to the operation end. A plant control device configured to output to an external display device via the.