Digital protection relay device and digital protection relay status display method

Abstract

To provide a digital protection relay device and a digital protection relay state display method in which operation and display can be continued even if a CPU that processes a display fails when a set of an actuator and a display unit is implemented in the digital protection relay device with dual CPUs.SOLUTION: A digital protection relay device includes: a plurality of CPUs 101 and 102 that execute protection calculations; a shutdown command output circuit 117 that outputs a shutdown command from all CPUs under AND conditions when the plurality of CPUs are all normal and outputs the shutdown command from the normal CPU when at least one of a plurality of calculation process units is failed; a state display unit 113 that displays the state of the plurality of CPUs; a display switching circuit 112 that switches the CPU to be displayed on the state display unit; and a select signal output circuit 116 that switches the CPU to be displayed on the display switching circuit 112 according to the output of the plurality of CPUs.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a digital protection relay device and a digital protection relay state display method. [Background technology]

[0002] Some digital protective relay devices used in power systems have a redundant arithmetic processing unit that controls relay tripping, improving reliability. In the following explanation, the arithmetic processing unit will be referred to as the CPU (Central Processing Unit).

[0003] Patent Document 1 describes a digital protective relay device with dual CPUs, in which two CPUs with the same program installed are used. That is, Patent Document 1 describes a device with identically configured CPUs "A" and "B," and when both CPUs are normally operating normally, the protected object is protected by the AND condition of their respective protection commands. If one of CPUs "A" or "B" fails, the protected object is protected only by the protection command of the operating CPU.

[0004] In this way, by duplicating the CPU of the digital protective relay device, when both CPUs are normal, the protection command output is output by the two CPUs in agreement, making it possible to prevent malfunction of the protection function. Also, even if one of the CPUs fails, the normal CPU will output the protection command, preventing malfunction and non-operation. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2012-100373 Summary of the Invention [Problem to be solved by the invention]

[0006] Digital protective relay devices have buttons for direct operation, a display device that shows the status, and a CPU that controls them, but in many cases the controlling CPU is also shared with the CPU that performs protection calculations. Therefore, if this CPU fails, the operator will lose the ability to directly operate the digital protective relay device and check its status.

[0007] When a CPU fails, checking the device's status or changing settings requires connecting an external device such as a PC (Personal Computer) to check the status or perform other operations. This requires time and effort to carry an external device such as a PC to the device, analyze the device's failure, and analyze the settings and error logs of the CPU that continues to provide protection.

[0008] Digital protection relay devices with duplicated CPUs require high reliability, so in addition to the CPU, components directly related to the protection function, such as clocks and A / D (Analog / Digital) converters, are also generally duplicated for each CPU.However, operation interfaces such as switches that operate the digital protection relay device and displays that show the operating status and operation status are not directly related to the protection function, so it is considered sufficient to install only one of these for one digital protection relay device.

[0009] If two CPUs are provided with their own operation interfaces and display devices, these devices will occupy a large area in the digital protective relay device, making the device larger and placing restrictions on the installation environment of the digital protective relay device. Furthermore, typical display devices such as LCDs (Liquid Crystal Displays), VFDs (Vacuum Fluorescent Displays), and fluorescent tubes are generally expensive. Therefore, installing two of these expensive display devices would increase the cost of the digital protection relay device. Therefore, it is not desirable to provide separate operation interfaces and display devices for each of the duplicated CPUs.

[0010] The present invention aims to provide a digital protection relay device and a digital protection relay status display method that can continue to operate and display when a set of operating devices and displays is installed in a digital protection relay device with dual CPUs and the CPU that performs display processing fails. [Means for solving the problem]

[0011] In order to solve the above problems, for example, the configurations described in the claims are adopted. The present application includes multiple means for solving the above problems, and one example is a digital protective relay device that is installed in a power system, monitors the current and voltage input from the power system, and controls a circuit breaker that protects the power system when an abnormality occurs. Here, the digital protective relay device comprises a plurality of arithmetic processing units that perform protective calculations to control the circuit breaker, a shutdown command output circuit that outputs shutdown commands from all of the arithmetic processing units using an AND condition when all of the plurality of arithmetic processing units are normal, and outputs a shutdown command from a normal arithmetic processing unit when at least one of the plurality of arithmetic processing units has failed, a status indicator that displays the status of the plurality of arithmetic processing units, a display switching circuit that switches the arithmetic processing units to be displayed on the status indicator, and a select signal output circuit that outputs a select signal that switches the arithmetic processing unit to be displayed by the display switching circuit depending on the output of the plurality of arithmetic processing units. When at least one of the plurality of arithmetic processing units fails, the select signal output circuit outputs a select signal so that the status of the normal arithmetic processing unit is displayed on the status indicator. When the display switching circuit switches the display target arithmetic processing unit to the arithmetic processing unit in which an abnormality has occurred, the select signal output circuit outputs a select signal that returns the switching in the display switching circuit so that the display target is the arithmetic processing unit in normal operation. . [Effects of the Invention]

[0012] According to the present invention, even if one of the multiple arithmetic processing units provided fails, the status display provided in the digital protection relay device can continue to display the control status as a digital protection relay device. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a configuration diagram showing an example of a digital protection relay device according to a first embodiment of the present invention. [Figure 2] 1 is a diagram showing an example of a configuration for displaying the operational status of a digital protection relay device according to a first embodiment of the present invention; [Figure 3] 1 is a diagram showing an example of the configuration of a select signal output circuit according to a first embodiment of the present invention; [Figure 4] FIG. 10 is a diagram showing a process in which the first CPU according to the first embodiment of the present invention fails and control of the status indicator is switched to the second CPU. [Figure 5] 3A and 3B are diagrams showing examples of displays on a status indicator according to the first embodiment of the present invention. [Figure 6] FIG. 2 is a diagram illustrating an example of mutual monitoring communication between CPUs according to the first embodiment of the present invention. [Figure 7] FIG. 10 is a diagram illustrating an example of processing when a synchronization error occurs in mutual monitoring communication between CPUs according to the first embodiment of the present invention. [Figure 8] 5 is a flowchart showing an example of mutual monitoring communication processing performed by a mutual monitoring communication transmitting side CPU (first CPU) according to the first embodiment of the present invention. [Figure 9] 10 is a flowchart showing an example of a mutual monitoring communication process performed by a mutual monitoring communication receiving side CPU (second CPU) according to the first embodiment of the present invention. [Figure 10] FIG. 4 is a timing diagram showing an example of state transition when an abnormality is detected in mutual monitoring communication according to the first embodiment of the present invention. [Figure 11] FIG. 10 is a configuration diagram showing an example of a digital protection relay device according to a second embodiment of the present invention (an example in which the CPU having control can be confirmed by display). [Figure 12]FIG. 10 is a configuration diagram showing an example of a digital protection relay device according to a third embodiment of the present invention (an example of switching between the display of a triplicate digital protection relay device and input from an operation interface). [Figure 13] FIG. 10 is a timing diagram showing an example of state transitions when an abnormality is detected in mutual monitoring communication in a triplex digital protection relay device according to a third embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0014] <First embodiment> A digital protection relay device and a digital protection relay state display method according to a first embodiment of the present invention will be described below with reference to the accompanying drawings.

[0015] [Device configuration] FIG. 1 shows an example of the configuration of a digital protection relay device 100 according to a first embodiment of the present invention. The digital protection relay device 100 has a dual configuration with two sets of calculation processing units, a first CPU 101 and a second CPU 102, and controls the interruption operation of a circuit breaker (not shown) through protection calculations performed by the first CPU 101 and the second CPU 102. Although not shown in the drawings, the first CPU 101 and the second CPU 102 each have a processor that executes arithmetic processing, as well as a memory required for the CPU to execute processing, an interface for input and output, etc. Furthermore, a program that executes the circuit breaker's breaking operation is installed in the memory connected to each of the CPUs 101 and 102.

[0016] In order to improve the reliability of the device, the peripheral circuits of the first CPU 101 and the second CPU 102, which are components directly related to the protection function, are also configured to be mounted in pairs. Specifically, the digital protection relay device 100 is equipped with two of each of the following: clock generation circuits 103, 104 that input operating clock signals to CPUs 101, 102; A / D converters 105, 106; and analog filters 107, 108 that create signals required for protection from analog signals from input converter 109. This allows the digital protection relay device 100 to continue providing protection functions even if one of these components fails, using the other component.

[0017] Furthermore, the digital protection relay device 100 displays the operating states of the first CPU 101 and the second CPU 102 on a status display 113. This status display 113 is connected to the two CPUs 101 and 102 via a display switching circuit 112, and performs status display processing to display the state of either CPU in response to an instruction from a select signal output circuit 116. Furthermore, the digital protection relay device 100 includes an operation interface 111. For example, components such as a plurality of push-type operation switches or a touch panel are used as the operation interface 111. A switch operation signal 128 of this operation interface 111 is input to the two CPUs 101 and 102 simultaneously.

[0018] The input converter 109 converts the current signal or voltage signal of the power system to be protected and controlled, which is obtained at input terminals 110a to 110n (n is any integer), into a signal to be handled by the digital protective relay device 100. This input converter 109 is also a component related to the protection function, but because it is structurally very simple and has a significantly lower failure rate than other components, it is not configured as a duplicated unit but is instead configured as a single unit. However, it is also possible to configure the input converter 109 as a duplicated unit.

[0019] The current / voltage (analog signal) obtained at the input terminals 110a to 110n is converted by the input converter 109 into a signal at a level that can be processed by the electronic circuit inside the digital protection relay device 100. The signal converted by the input converter 109 passes through the analog filter 107 and the analog filter 108, and then is input to the A / D converters 105 and 106. The A / D converters 105 and 106 convert the input current / voltage (analog signal) into digital signals 129 and 130 that can be calculated by the CPU, and supply them to the first CPU 101 and the second CPU 102.

[0020] The first CPU 101 and the second CPU 102 perform calculations for the protection function. The first CPU 101 and the second CPU 102 also perform mutual monitoring communication 127, which periodically checks whether the other CPU is operating normally. If an abnormality occurs in the communication from the other CPU and is detected, each CPU 101, 102 outputs a control right request signal 119, 120 to the first pulse output circuit 114 or the second pulse output circuit 115. Upon receiving the control right request signal 119 or 120, the first pulse output circuit 114 or the second pulse output circuit 115 outputs a one-shot pulse signal 121 or 122 to the select signal output circuit 116.

[0021] The select signal output circuit 116, to which the one-shot pulse signal 121 or 122 is input, outputs a select signal 123 to the display switching circuit 112 to switch the CPU 101 or CPU 102 connected to the status indicator 113. The CPU 101 or CPU 102, which outputs the control right request signal 119 or 120, causes the display switching circuit 112 to execute display switching. Then, the CPU 101 or CPU 102 obtains the control right of the status indicator 113 and simultaneously transitions the state so as to validate the switch operation signal from the operation interface 111.

[0022] The first CPU 101 and the second CPU 102 operate independently with operating clocks input from the first clock generation circuit 103 and the second clock generation circuit 104, and each CPU performs protection calculations based on the current and voltage values ​​of the digital signals obtained from the A / D converters 105 and 106. If an accident in the equipment to be protected is detected based on the calculation results, the CPU 101 or the CPU 102 outputs trip signals 131 and 132 to the shutdown command output circuit 117.

[0023] The trip command output circuit 117 receives trip signals 131, 132 from the first CPU 101 and the second CPU 102, and performs trip command output processing to output a trip command to an external circuit breaker (not shown) via trip command output terminals 118a to 118n (n is an arbitrary integer). When both the first CPU 101 and the second CPU 102 are normal, the trip signal 131 of the first CPU 101 and the trip signal 132 of the second CPU 102 are output under an AND condition, so that unnecessary tripping due to a single fault is not caused. Also, by bypassing the failed CPU, even if either the CPU 101 or the CPU 102 becomes abnormal due to a fault, a shutdown command is output only with the trip signal 131 or 132 of either the normal CPU 101 or the CPU 102, providing a temporary degenerate operation function and realizing system protection that can prevent malfunctions.

[0024] The first CPU 101 and the second CPU 102 also display information such as normal current and voltage stored internally and information on the current and voltage currently being input on a status indicator 113 via a display switching circuit 112. The first CPU 101 and the second CPU 102 also allow an operator to change part of the information stored in the CPU or perform a simple operation check test by operating the operation interface 111.

[0025] The first CPU 101 and the second CPU 102 are connected to a status indicator 113 via a display switching circuit 112 . Furthermore, when both the first CPU 101 and the second CPU 102 are in a normal state, the first CPU 101, which is the primary CPU, is connected to a status indicator 113 via a display switching circuit 112 to display the device status, etc.

[0026] If the first CPU 101 fails, the second CPU 102 on the secondary side detects the abnormality through mutual monitoring communication 127 and outputs a control right request signal to the select signal output circuit 116 via the second pulse output circuit 115. The select signal output circuit 116 outputs a select signal 123 to the display switching circuit 112 to connect the second CPU 102 and the status indicator 113.

[0027] The switch operation signal 128 of the operation interface 111 is input simultaneously to the first CPU 101 and the second CPU 102, but if both CPUs are normal, only the first CPU 101 on the primary side recognizes the switch operation signal and performs an operation. Then, even if the second CPU 102 on the secondary side recognizes the switch operation signal, it invalidates it and does not perform the predetermined operation.

[0028] Furthermore, when information stored in the first CPU 101 is changed by operating the operation interface 111, the first CPU 101 transmits the details of the change to the second CPU 102 through communication. Then, the second CPU 102 changes its own information based on the received details of the change. With this operation, even if the second CPU 102 invalidates the switch operation signal from the operation interface 111, if the information of the first CPU 101 is changed by the operation interface 111, there will be no difference in the stored information between the first CPU 101 and the second CPU 102.

[0029] Furthermore, the normal signal of the first CPU 101 and the normal signal of the second CPU 102 are supplied to a gate circuit 210, and three LEDs (Light Emitting Diodes) 201, 202, and 203 are individually lit according to the states of the two normal signals to display the operation status. The operation status display by the three LEDs 201, 202, and 203 will be described with reference to FIG. 2.

[0030] [Configuration for displaying operational status] FIG. 2 is a diagram showing an example of a configuration for displaying the operation status of the device in the digital protection relay device 100. The first CPU 101 and the second CPU 102 output normal signals 206, 207 when operating normally, and the output normal signals 206, 207 of each CPU are supplied to an AND circuit 211, an OR circuit 212, and an EXOR circuit 213 in a gate circuit 210. The output of the AND circuit 211 is supplied to a normality indication LED 201, the output of the OR circuit 212 is supplied to an abnormality indication LED 202, and the output of the EXOR circuit 213 is supplied to a degenerate operation indication LED 204.

[0031] As a result, when the two CPUs 101, 102 are normal, the normal display LED 201 lights up, and when an abnormality occurs in either of the two CPUs 101, 102 (when neither of the normal signals 206, 207 is output), the abnormal display LED 202 lights up. Also, when an abnormality occurs in one of the CPUs 101 or 102 and the other CPU 101 or 102 continues to perform its protection function (when either of the normal signals 206 or 207 is not output), the degenerate operation display LED 204 lights up. Also, each of the LEDs 201, 202, 203 is turned off when the respective state does not apply.

[0032] [Configuration and operation of the select signal output circuit] FIG. 3 is a diagram showing the connection configuration and operation between the first CPU 101, the second CPU 102, and the select signal output circuit 116. When the power supply of the digital protection relay device 100 is turned on, the first CPU 101 on the primary side first outputs a control right request signal 119 to the first pulse output circuit 114 to acquire control right of the status indicator 113 (Figure 1). The first pulse output circuit 114 detects the rising edge of the input control right request signal 119, and outputs a pulse signal (one-shot pulse) 121 to the select signal output circuit 116 once for each rising edge.

[0033] The select signal output circuit 116 detects the input (first input) from the first CPU 101 and the input (second input) from the second CPU 102, and outputs a select signal 123 so that the side to which the pulse is input can take control. The output select signal 123 is supplied to the first CPU 101 and the second CPU 102 as signals 301 and 302. When each of the CPUs 101 and 102 outputs a control right request signal 119 or 120, the select signal output circuit 116 checks whether the control right has been correctly acquired. For example, when "1" is output as the select signal 123, the control right belongs to the first CPU 101, and when "0" is output, the control right belongs to the second CPU 102. In this case, the first CPU 101 checks that it has the control right by checking that the signal 300 from the select signal output circuit 116 is "1."

[0034] To explain an example where this function is effective, consider a case where the first CPU 101 is normal and an abnormality occurs in the second CPU 102. That is, if the control right request signal 120 of the second CPU 102 is fixed at outputting a control right request, the second pulse output circuit 115 detects the rising edge 311 of the control right request signal 120 and supplies a one-shot pulse 312 to the second input of the select signal output circuit 116.

[0035] At this time, the select signal 120 of the second CPU 102 is output, and the second CPU 102 temporarily acquires control of the status indicator 113. The output select signal 123 is then input to the first CPU 101 as signal 301, but since the first CPU 101 on the primary side, which is operating normally, has the control, the first CPU 101 immediately outputs the control request signal 119 again and acquires the control again. In this way, even if an abnormality occurs in the second CPU 102 and the control right request signal continues to be output, the one-shot pulse signal 312 is output by the second pulse output circuit 115, so that the control right is not fixed to the second CPU 102, and the first CPU, which is a normal CPU, can obtain the control right again.

[0036] [Display switching behavior] FIG. 4 is a diagram showing a process of switching the control right of the status indicator 113 to the second CPU 102 when the first CPU 101 fails in the digital protection relay device 100. If the first CPU 101 fails, the second CPU 102 outputs a control right request signal to the select signal output circuit 116 through mutual monitoring communication. Upon receiving the control right request signal from the second CPU 102, the select signal output circuit 116 transmits a select signal 123 to the display switching circuit 112. This causes the display switching circuit 112 to switch the connection so that the display data of the second CPU 102 is input to the status indicator 113. At the same time, the second CPU 102 checks the status of the switch operation signal input from the operation interface 111, which is disabled when the first CPU 101 is normal, and performs processes such as displaying saved information and changing settings.

[0037] [Status indicator display example] 5 shows an example of the display on the status indicator 113. Here, an example of the display of setting information configured from the first to fourth layers is shown. First, the initial display 113a shows "SETUP." "SETUP" is a display mode for performing various settings of the digital protection relay device 100. From here, the operator presses an operation switch or the like on the operation interface 111 that has a "→" symbol, for example, to transition to the display of the second hierarchical level 113b. Furthermore, when transitioning to a different item within the same hierarchical level, the displayed item is transitioned by operating an operation switch or the like that has a symbol such as "↑" or "↓." The second layer allows you to set test-related settings and date and time.

[0038] When transitioning from "SETUP" on the first level (initial display 113a) to the second level 113b, "CHECK" is displayed, which is a setting display for switching between manual and automatic inspection modes. To switch inspection modes, the operator can press an operation switch or the like marked with the "→" symbol to transition directly to the inspection mode setting display 113c on the third level, where settings can be made. In the setting operation, after selecting "AUTO" for automatic inspection or "MANUAL" for manual inspection, the inspection mode can be set by operating an operation switch or the like marked with a positive sign such as "OK."

[0039] Furthermore, when "CHECK" on the second hierarchical layer 113b is displayed, for example, if the operator presses an operation switch or the like bearing the "↓" symbol, the display transitions to "TEST." Furthermore, if the operator presses an operation switch or the like bearing the "→" symbol while "TEST" is displayed, the display transitions from "TEST" to the test setting display 113d on the third hierarchical layer. Then, by selecting "DOTEST," which was initially displayed on the test setting display 113d on the third hierarchical layer, and operating the operation switch to "confirm," the test of the digital protective relay device 100 can be carried out.

[0040] Furthermore, in the test setting display 113d, when "DOTEST" is displayed, if the operator presses an operation switch or the like marked with the "↓" symbol, the operator can enter any numerical values, characters, etc. to set the conditions for conducting a test of the digital protective relay device 100. In the example of Fig. 5, the test target is set to the short circuit selective relay "50L" or the earth fault selective relay "50M", and the setting value is set to 10 times the rated load voltage (or rated load current), "x10".

[0041] Furthermore, after transitioning from "TEST" to "TIME" on the second hierarchical level 113b, transition is made from "TIME" to the date setting display 113e on the third hierarchical level. On the date setting display 113e, it is possible to set the date when the setting operation of the digital protection relay device 100 was performed. Furthermore, transition is made from "YEAR," "MONTH," and "DAY" on the date setting display 113e on the third hierarchical level to the fourth hierarchical level 113f, where values ​​for each item can be set.

[0042] Furthermore, when referring to information set in the digital protective relay device 100, an operation to transition from "SETUP" in the initial display 113a on the first hierarchical level to another item is performed, and "STATUS" is displayed in the information reference display 113g. Then, from the state in which "STATUS" is displayed, transition to the second hierarchical level 113h and operations such as "↑" and "↓" are performed to refer to information such as values ​​set in the digital protective relay device 100, input value information, and date. For example, the example in FIG. 5 shows information such as the operating condition of the protective function being "10.0A," the setting target being "RELAY," the type being "51_IS," the current load current being "2.5A," and the current time "TIME" set in the digital protective relay device 100 being "2021."

[0043] [Mutual monitoring communication] 6 and 7 are diagrams showing an example of mutual monitoring communication 127 performed between the first CPU 101 and the second CPU 102 in the digital protection relay device 100. FIG. FIG. 6 shows the transition of communication processing performed between the first CPU 101 and the second CPU 102. The first CPU 101, which is the transmitting side, transmits numeric data to the second CPU 102, which is the receiving side, at a fixed transmission cycle ([n] ms) 516. Here, the numeric value of the data is incremented by 1 for each transmission, and the second CPU 102 confirms that the numeric value of the data is being added correctly, thereby allowing the second CPU 102 to confirm that the first CPU 101, which is the transmitting side, is operating correctly.

[0044] The second CPU 102 checks the data every check period ([n] ms) 517, asynchronously with the timing of transmission by the first CPU 101. The first CPU 101 and the second CPU 102 also have dual clocks, each with its own clock generation circuit 103, 104, and are therefore not synchronized with each other.

[0045] The second CPU 102 has a memory storage area 501 for storing data transmitted from the first CPU 101. The memory storage area 501 has an area for current data [N] that stores the transmission signal 500, and an area for data [N-1] that is immediately before the current data. The second CPU 102 performs an operation 502 of writing the received data into the area [N] by interrupt processing at the timing of receiving data from the first CPU 101. The second CPU 102 also checks the data at the timing of a check operation 503.

[0046] The confirmation may involve, for example, calculating [N]-[N-1] and confirming that the result is "1." When confirmation operation 503 is completed, the second CPU 102 performs operation 504 of writing the data of [N] to [N-1]. Operation 505 of performing normality confirmation operation 503 and write operation 504 is performed by polling processing of the second CPU 102. Furthermore, operation 505 is performed at a confirmation period ([n] ms) 517 based on the clock of the second CPU 102.

[0047] Then, after the transmission period ([n] ms) 516 has elapsed, the first CPU 101 transmits 506 the numerical value "2" obtained by adding 1 to the numerical value "1" that was transmitted initially. The second CPU 102 then receives the numerical value "2" and writes "2" to [N] at the time of reception. At this point in time, in the memory storage area 508, "2" is written to [N] and "1" is written to [N-1].

[0048] When the next confirmation period 517 has elapsed, the second CPU 102 checks the contents written in the memory storage area 508, and after checking that they are normal, writes "2" to [N-1]. Even if an abnormality 509 occurs in the first CPU 101 and no data is sent, the second CPU 102 performs a check at the next confirmation timing 510. At this time, the second CPU 102 also checks the data in the memory storage area 511, but because no data has been received, the numerical values ​​of [N] and [N-1] are both "2", and the result of [N] - [N-1] is "0".

[0049] In this embodiment, the second CPU 102 allows the result to be "0" up to one time, and if the result of the check is "0" twice in a row, it determines that there is an "abnormality." Therefore, at the check timing 510 in FIG. 6, it does not determine that there is an abnormality. Then, when the abnormality continues at the next transmission timing 512 and no data is transmitted from the first CPU 101, the data in the memory storage area 514 at the next confirmation timing 513 of the second CPU 102 will be "0" as in the previous time, with the result of [N]-[N-1] being "0". When this happens twice in a row, the second CPU 102 performs abnormality confirmation 515. As a result, the second CPU 102 outputs a control right request signal 120 (FIG. 3) to acquire the control right of the status indicator 113.

[0050] As already explained, the first CPU 101 and the second CPU 102 each have their own clock, so their transmission and reception timings are not synchronized. For this reason, as the number of transmissions and receptions increases, the difference between the transmission timing and the confirmation timing becomes larger.

[0051] FIG. 7 shows an example of the processing state when this deviation occurs. First, the first CPU 101 transmits 600 the numeric value "1", which is received by the second CPU 102. Then, the second CPU 102 writes 602 to the memory storage area [N] and confirms 601 the written data.

[0052] Next, the first CPU 101 transmits 603 the number "2", which is received by the second CPU 102. Then, the first CPU 101 writes 605 to memory storage area [N] and performs 604 confirmation of the written data. Next, it is assumed that due to a synchronization error, the first CPU 101 transmits a numerical value twice during the confirmation period ([n] ms) 517 (FIG. 6) of the second CPU 102. That is, after confirmation 604 in the second CPU 102, the first CPU 101 transmits 606 the number "3", and before the second CPU 102 receives and confirms the number, the first CPU 101 transmits 607 the next number "4".

[0053] Here, the second CPU 102 enters a state 610 in which it checks 608 the received data for which "4" has been written 609 in the storage area [N]. In this case, the value of [N]-[N-1] in confirmation 608 is "2." By taking into consideration such a synchronization error and allowing the value to be "2" up to once, it is possible to avoid erroneous detection of an abnormality even if the first CPU 101 transmits a numerical value twice within the confirmation period of the second CPU due to a synchronization error.

[0054] Also, as an opposite event, consider a state 616 in which the second CPU 102 checks twice during one cycle in which the first CPU 101 transmits a numerical value, where the first CPU 101 transmits 611 a numerical value "5" and the second CPU 102 checks 612 the received data. In this case, in writing 613 to the storage area, the value of [N]-[N-1] becomes "1", and the second CPU 102 checks that the operation is normal.

[0055] Here, if a confirmation is performed again before the next data is received, the contents are confirmed at confirmation timing 614 and the value of [N]-[N-1] becomes "0." In this case as well, by allowing the confirmation result value to become "0" only once, when the first CPU 101 next transmits the number "6" 617, the second CPU 102 writes the value to the storage area 619. As a result, the second CPU 102 obtains a normal confirmation result of "1" at confirmation timing 618, and similarly, erroneous detection of an abnormality can be avoided.

[0056] Note that the examples shown in Figures 6 and 7 have been described as examples in which the first CPU 101 transmits and the second CPU 102 receives, but communication between the first CPU 101 and the second CPU 102 is mutual, with the second CPU 102 also performing a similar transmission operation, and the first CPU 101 also simultaneously performing the reception and confirmation operation.

[0057] [Processing on each CPU] The first CPU 101 and the second CPU 102 that are performing mutual monitoring communication are not synchronized, and therefore each performs its own processing. 8 and 9 are flowcharts showing an example of processing by each CPU. In Fig. 8 and Fig. 9, the first CPU 101 is the transmitting side and the second CPU 102 is the receiving side.

[0058] FIG. 8 is a flowchart showing the processing of the first CPU 101 on the transmitting side. When the first CPU 101 starts the process (step S10), it checks whether the first CPU 101 is normal or not (step S11). If the first CPU 101 is normal in step S11 (YES in step S11), the first CPU 101 performs a process of sending a numerical value "X" (X is any integer) to the second CPU 102 (step S12). After sending the numerical value "X", the first CPU 101 performs a process of setting the numerical value to "X+1" (step S13), and increases the value to be sent next by one.

[0059] Then, after a fixed transmission period "n" ms has elapsed (step S14), the first CPU 101 performs the same processing again from step S11. Furthermore, if the first CPU 101 is not normal in step S11 (NO in step S11), an abnormality has occurred in the first CPU 101, and so operation is stopped (step S15). Due to this stop of operation, the transmission process of the numerical value "X" from the first CPU 101 is not executed.

[0060] FIG. 9 is a flowchart showing the processing of the second CPU 102 on the receiving side. The second CPU 102 starts processing (step S30), and when the confirmation period "n" ms has elapsed (step S31), it checks the difference between the numerical values ​​stored in memory areas [N] and [N-1] and determines whether the difference between the numerical values ​​is "1" (step S32). If the difference in the numerical values ​​is "1" in step S32 (YES in step S32), the second CPU 102 performs processing to reset the error count to "0" as normal (step S33). Thereafter, the second CPU 102 performs a process of writing the numerical value of the memory area [N] into the memory area [N-1] (step S34), and returns to the process of step S31.

[0061] If the difference in the numerical values ​​is not "1" in step S32 (NO in step S32), the second CPU 102 determines whether the result is "0" or "2" (step S35). If the result in step S35 is not "0" or "2" (NO in step S35), the second CPU 102 detects an abnormality in the first CPU 101 (step S38) and outputs a control right request signal (step S39). If the result in step S35 is "0" or "2" (YES in step S35), the second CPU 102 performs processing to increment the error count by "1" (step S36). Then, the second CPU 102 determines whether the error count is 2 or not (step S37).

[0062] In step S37, if the error count is "1" (NO in step S37), the second CPU 102 proceeds to the process of step S34, performs the process of writing the numerical value in memory area [N] to memory area [N-1], and returns to the process of step S31. If the error count is "2" in step S37 (YES in step S37), the second CPU 102 proceeds to step S38, detects an abnormality in the first CPU 101, and outputs a control right request signal in step S39.

[0063] The second CPU 102 simultaneously performs interrupt processing (step S21), and when it receives the numerical value "X" transmitted by the first CPU 101 (step S22), it writes the received numerical value "X" in the memory area [N] (step S23) and completes the interrupt processing (step S24). This interrupt processing is executed by the second CPU 102 whenever the numerical value "X" is received from the first CPU 101.

[0064] [Processing when control is transferred from the first CPU to the second CPU] FIG. 10 shows an example of the processing timing when the control right of the display device is transferred from the first CPU 101 to the second CPU 102 when an abnormality occurs in the first CPU 101. The first CPU 101 transmits numeric data to the second CPU 102 at a timing of a transmission period 900 shown in Fig. 10(a). The second CPU 102 checks the received data at a timing of a check period 901 shown in Fig. 10(b). FIG. 10(c) shows the state (normal or abnormal) of the first CPU 101, and FIG. 10(d) shows the timing at which the second CPU 102 detects the abnormality of the first CPU 101. FIG. 10( e ) shows the control authority 904 of the status indicator 113 .

[0065] Here, it is assumed that an abnormality occurs in the first CPU 101 and the operation stops at timing 906 after the first CPU 101 transmits a numerical value at specific timing 905 in the transmission cycle 900 of the first CPU 101 shown in FIG. 10(a). Until this operation stops, the first CPU 101 has control 904 of the status indicator 113, as shown in Figure 10(e), and from the timing 907 when the first CPU 101 stops due to an abnormality, the control of the status indicator 113 becomes indefinite 908.

[0066] 10(d), the second CPU 102 determines that the system is normal at the first check timing 909 after the abnormality occurs. Furthermore, the second CPU 102 increments the error count by 1 at the next check timing 910 and returns to normal processing. Then, at the next check timing 911, an abnormality is detected 912, and the second CPU 102 obtains control at timing 913 when it transmits a control request signal from the status indicator 113.

[0067] As described above, according to the digital protective relay device 100 of this embodiment, even if one of the multiple CPUs 101, 102 fails, the control status can continue to be displayed on the status indicator 113. This makes it possible to increase the availability of the digital protective relay device 100.

[0068] Furthermore, in this embodiment, when two CPUs 101, 102 communicate with each other to check their status, if an abnormality is detected twice in succession, it is determined that an abnormality has occurred in the other CPU, thereby preventing malfunctions due to abnormality detection and appropriately switching the control right of the status indicator 113. In particular, when the two CPUs 101, 102 operate on separate clocks, as in this embodiment, detection is performed asynchronously, making it possible to more effectively prevent malfunctions due to abnormality detection.

[0069] Furthermore, in addition to the status indicator 113, the digital protection relay device 100 of this embodiment is equipped with a normality indicator LED 201, an abnormality indicator LED 202, and a degenerate operation indicator LED 203, which indicate whether the two CPUs 101, 102 are normal, one is abnormal, or both are abnormal, allowing the operator to properly diagnose the status using only the display on the digital protection relay device 100.

[0070] <Second embodiment> Next, a second embodiment of the present invention will be described with reference to Fig. 11. In Fig. 11, the same parts as those in Figs. 1 to 10 described in the first embodiment are given the same reference numerals, and duplicated explanations will be omitted. In this embodiment, the configuration for switching the display data of the status indicator 113 differs from that of the first embodiment.

[0071] [Display switching circuit configuration] FIG. 11 is a diagram showing a configuration for switching display data in the status indicator 113. As shown in FIG. As explained in the first embodiment, the digital protection relay device 100 is configured to switch control of the status indicator 113 to the second CPU 102 when the first CPU 101 set on the primary side fails and the protection function is continued only by the second CPU 102 on the secondary side. At the same time, the switch operation signal from the operation interface 111 is enabled to continue the operation by the operator and the display of the device status by the status display 113. Here, in this embodiment, it is possible to easily check from the outside which CPU has the control right.

[0072] 11, the first CPU 101 and the second CPU 102 are connected to a display switching circuit 700. The display switching circuit 700 includes a switching unit 701 that switches the connection of the status indicator 113, and a switching unit 702 that switches the connection of LEDs 704 and 705, and the switching units 701 and 702 switch in conjunction with each other. The switching operation of the display switching circuit 700 is executed by a select signal 123 (FIGS. 3 and 4), and the switching unit 701 switches so that display data from the CPU 101 or 102 that has control is supplied to the status indicator 113. The LED 704 is a first CPU status display LED, and the LED 705 is a second CPU status display LED, and the side to which the LED lighting circuit 703 is connected by the switching unit 702 lights up.

[0073] Then, by switching unit 702 in conjunction with switching unit 701, a first CPU status display LED 704 lights up when the switching state is such that display data for first CPU 101 is being supplied to status indicator 113. Also, a second CPU status display LED 705 lights up when the switching state is such that display data for second CPU 102 is being supplied to status indicator 113. Therefore, the first CPU status display LED 704 and the second CPU status display LED 705 function as notification units that notify the user of the CPU that has control.

[0074] Operation signals from the operation interface 111 are supplied to both the first CPU 101 and the second CPU 102, and the CPU 101 or 102 that has control executes processing based on the operation signals. Furthermore, the first CPU 101 and the second CPU 102 perform mutual monitoring communication 127 to periodically check that the other CPU is operating normally, and when settings or the like are changed in one CPU based on an operation signal, the other CPU changes the settings to the same state.

[0075] As described above, according to the digital protection relay device 100 of this embodiment, it is possible to indicate which CPU has control by providing the first CPU status display LED 704 and the second CPU status display LED 705. Therefore, if, for example, one of the CPUs fails, an operator can immediately determine which CPU has failed, and can take prompt action such as repair. 11, as explained in Fig. 2 of the first embodiment, the digital protection relay device 100 is provided with a normal operation indicator LED 201 and a degenerate operation indicator LED 203, so that it is possible to know whether the device is operating normally or whether one of the CPUs has failed. Therefore, by combining the indications of these LEDs 201 to 203 with the indications of LEDs 704 and 705, the operator can more appropriately determine the state of the digital protection relay device 100.

[0076] <Third embodiment> Next, a third embodiment of the present invention will be described with reference to Figures 12 and 13. In Figures 12 and 13, the same parts as those in Figures 1 to 11 described in the first and second embodiments are given the same reference numerals, and duplicated explanations will be omitted. In this embodiment, three CPUs are installed to achieve triple redundancy.

[0077] [Configuration of digital protective relay device] FIG. 12 shows an example of the configuration of a triplex digital protection relay device in which a first CPU 801, a second CPU 802, and a third CPU 803 are implemented. The triplicate digital protective relay device is equipped with a majority logic circuit 1108 as a mechanism for receiving trip signals issued from the CPUs, which is the original role of the digital protective relay device, and outputting a trip command to the outside. The majority logic circuit 1108 is a circuit that outputs trip commands, takes a majority vote of the trip signals issued from the three CPUs 801, 802, and 803, and outputs a trip command to the outside if two or more trip signals are input simultaneously.

[0078] As shown in the majority logic circuit input / output relationship 831, the condition under which the shutdown command is output by the majority logic circuit 1108 is that when there is a shutdown command output of "1" from any two or three CPUs, the output "1" is output to the outside as is. Also, when there is a shutdown command output of "1" from only one CPU, the output to the outside is set to "0" and no shutdown command is output. Also, when three CPUs output "0", the output to the outside is set to "0" and no shutdown command is output.

[0079] Each of the CPUs 801, 802, and 803 is connected to one another to perform mutual monitoring communication 811, and is connected to two CPUs other than itself to perform mutual monitoring. As shown in a mutual monitoring communication relationship 812, the first CPU 801 checks the status of the second CPU 802 and the third CPU 803, the second CPU 802 checks the status of the first CPU 801 and the third CPU 803, and the third CPU 803 checks the status of the first CPU 801 and the second CPU 802.

[0080] Even when three CPUs 801, 802, and 803 are installed in this way, by determining the priority order, it is possible to switch the display switching circuit 820 in the event of a failure. The display switching circuit 820 switches the display data from the three CPUs 801, 802, and 803 and supplies it to the status indicator 113. The switching in the display switching circuit 820 is performed by a select signal from a select signal output circuit 821. In addition, an operation signal from the operation interface 813 is supplied to all of the CPUs 801, 802, and 803. Here, the first CPU 801 is assumed to be a primary CPU, the second CPU 802 is assumed to be a secondary CPU, and the third CPU 803 is assumed to be a tertiary CPU.

[0081] For example, if the first CPU 801, which is the primary, fails and stops, the second CPU 802 and the third CPU 803 detect the abnormality, and the second CPU 802, which is the secondary, outputs a control right request signal to the select signal output circuit 821. As a result, the display switching circuit 820 is switched by the select signal from the select signal output circuit 821, and the second CPU 802 performs the display on the status indicator 113, and at the same time, the second CPU 802 enables the switch operation signal from the operation interface 813.

[0082] During this switching process, the second CPU 802 and the third CPU 803 confirm normal operation through mutual monitoring communication 811, so the tertiary third CPU 803 confirms that the secondary second CPU 802 is normal and does not output a select signal.

[0083] [Example of display control right transition] FIG. 13 shows an example of the transition of the display control right in a triplex digital protection relay device. In the example of Figure 13, the first CPU 801 is the transmitting side, and the second CPU 802 and the third CPU 803 are the receiving sides. The first CPU 801 fails, and control is transferred to the second CPU 802. Figures 13(a), (b), and (c) show the confirmation periods of the CPUs 801, 802, and 803, and Figure 13(d) shows whether the first CPU 801 is normal or abnormal. Figures 13(e) and (f) show abnormality detection by the second CPU 802 and the third CPU 803, and Figure 13(g) shows the control 970 of the status indicator 113.

[0084] 13(a), the first CPU 801 transmits data to the second CPU 802 and the third CPU 803 at the timing of a transmission period 910. Then, as shown in FIGS. 13(b) and 13(c), the second CPU 802 and the third CPU 803 confirm the received data at their respective confirmation periods 920 and 930. Here, if an abnormality occurs in the first CPU 801 at timing 940 as shown in FIG. 13(d) after transmission at timing 911 of the transmission cycle 910 of the first CPU 801, the control right 970 of the status indicator 113 becomes indefinite 972 at timing 971 as shown in FIG. 13(g).

[0085] At this time, the second CPU 802 performs abnormality detection 950 as shown in Fig. 13(e) at timing 921, which is two cycles after the last transmission timing 911 of the first CPU 801. As a result, the second CPU 802 outputs a control right request signal, and the control right 970 of the display device 113 is transferred to the second CPU 802 at timing 973 as shown in Fig. 13(g). Furthermore, after detecting an abnormality in the second CPU 802, the third CPU 803 also detects an abnormality in the first CPU 801 at timing 960, as shown in Figure 13(e), but does not output a control right request signal because the second CPU 802 is normal.

[0086] As described above, the digital protection relay device 100 of this embodiment has a triplex configuration with three CPUs, which allows for more reliable control of the circuit breaker by majority vote and allows the display on the status indicator 113 to be switched appropriately.

[0087] <Modification> The embodiments described above have been described in detail to make the present invention easier to understand, and are not necessarily limited to those having all of the configurations described. Furthermore, the configurations and processes described in the above-described embodiments can be modified or changed in various ways. For example, the triplexed digital protection relay device 100 shown in FIG. 12 omits the LED display configuration, but the display switching configurations of the LEDs described in FIG. 2 and FIG. 11 may be combined. Furthermore, although the digital protection relay device 100 shown in FIG. 12 has a triplexed CPU configuration, it may have more CPUs, such as quintuple CPUs.

[0088] In the above-described embodiment, a CPU is used as the arithmetic processing unit, but other arithmetic processing units may be used. Part or all of the functions may be realized by dedicated hardware such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC).

[0089] Furthermore, in the configuration diagrams such as Figure 1, only control lines and information lines that are considered necessary for explanation are shown, and not all control lines and information lines in the product are necessarily shown. In reality, it can be assumed that almost all components are interconnected. Also, with regard to the flowcharts shown in Figure 8, etc., the processing order may be changed or multiple processes may be executed simultaneously as long as the processing results are the same.

[0090] Furthermore, the arithmetic processing unit (CPU) needs to be equipped with a program that executes the processing described in the flowcharts such as Figures 8 and 9. In addition to being stored in a memory provided in the arithmetic processing unit, the program may also be stored on a recording medium such as an external memory, an IC card, an SD card, or an optical disk and transferred to the arithmetic processing unit. [Explanation of symbols]

[0091] 100...digital protection relay device, 101...first CPU, 102...second CPU, 103...first clock generation circuit, 104...second clock generation circuit, 105...A / D converter, 107...analog filter, 108...analog filter, 109...input converter, 110...input terminal, 111...operation interface, 112...display switching circuit, 113...status indicator, 114...first pulse output circuit, 115...second pulse output circuit, 116...select signal output circuit, 117...shutdown command output circuit, 118...shutdown command output terminal, 119...control right request signal, 120...select signal, 121...one-shot pulse signal, 123...select signal, 127...mutual monitoring communication, 128...switch operation signal, 129...digital signal, 131...trip signal, 132...Trip signal, 201...Normal display LED, 202...Abnormal display LED, 203...Degenerate operation display LED, 204...Degenerate operation display LED, 206...Normal signal, 210...Gate circuit, 211...AND circuit, 212...OR circuit, 213...EXOR circuit, 700...Display switching circuit, 701, 702...Switching unit, 703...LED lighting circuit, 704...First CPU status display LED, 705...Second CPU status display LED, 801...First CPU, 802...Second CPU, 803...Third CPU, 813...Operation interface, 820...Display switching circuit, 821...Select signal output circuit, 830...Majority logic circuit

Claims

1. A digital protective relay device that is installed in a power system, monitors the current and voltage input from the power system, and controls a circuit breaker that protects the power system when an abnormality occurs, a plurality of arithmetic processing units that perform protection calculations to control the circuit breakers; a shutdown command output circuit that outputs shutdown commands from all of the arithmetic processing units under an AND condition when all of the plurality of arithmetic processing units are normal, and outputs a shutdown command from a normal arithmetic processing unit when at least one of the plurality of arithmetic processing units has failed; a status indicator that displays the status of the plurality of arithmetic processing units; a display switching circuit for switching the arithmetic processing unit to be displayed by the status indicator; a select signal output circuit that outputs a select signal that switches the arithmetic processing unit to be displayed by the display switching circuit in accordance with outputs of the plurality of arithmetic processing units, when at least one of the plurality of arithmetic processing units fails, the select signal output circuit outputs a select signal to cause the status indicator to display the status of a normal arithmetic processing unit; When the display switching circuit switches the display target arithmetic processing unit to the arithmetic processing unit in which an abnormality has occurred, the select signal output circuit outputs a select signal that switches back the display switching circuit so that the display target is the arithmetic processing unit in normal operation. Digital protective relay device.

2. The plurality of arithmetic processing units communicate with each other to confirm that the other arithmetic processing units are normal. The digital protection relay device according to claim 1.

3. Further, an operation interface is provided for supplying operation signals to the plurality of arithmetic processing units, and the plurality of arithmetic processing units are configured to perform mutual monitoring communication; An operation signal from the operation interface is supplied to all the arithmetic processing units, and among the plurality of arithmetic processing units, the arithmetic processing unit having the control right executes processing based on the operation signal, and the arithmetic processing unit not having the control right is set to the same state as the arithmetic processing unit having the control right through the mutual monitoring communication with the arithmetic processing unit having the control right. The digital protection relay device according to claim 1.

4. Further, a notification unit is provided for notifying the arithmetic processing unit whose display is being selected by the display switching circuit. The digital protection relay device according to claim 1.

5. The plurality of arithmetic processing units are provided in the number of three or more, the shutdown command output circuit outputs a shutdown signal by majority vote; The three or more arithmetic processing units communicate with each other, and when an abnormality is detected in any of the arithmetic processing units of the communication partners, the three or more arithmetic processing units output a select signal to the select signal output circuit to instruct switching. The digital protection relay device according to claim 1.

6. A digital protective relay status display method for controlling the display of a digital protective relay device that is installed in a power system, monitors current and voltage input from the power system, and controls, with a plurality of arithmetic processing units, circuit breakers that protect the power system when an abnormality occurs, a shutdown command output process for outputting shutdown commands from all of the arithmetic processing units under an AND condition when all of the plurality of arithmetic processing units are normal, and outputting a shutdown command from a normal arithmetic processing unit when at least one of the plurality of arithmetic processing units has failed; a status display process for displaying the status of the plurality of arithmetic processing units; a display switching process for switching the arithmetic processing unit to be displayed that performs the state display process in accordance with outputs of the plurality of arithmetic processing units, in the display switching process, when at least one of the plurality of arithmetic processing units has failed, switching is performed in the status display process so as to display the status of a normal arithmetic processing unit; When the arithmetic processing unit to be displayed in the status display process is switched to an arithmetic processing unit in which an abnormality has occurred, the display switching process switches back to displaying an arithmetic processing unit that is operating normally. Digital protection relay status display method.

Images