Redundancy switching method and system of high-voltage direct-current transmission control protection system

Abstract

The invention relates to a redundancy switching method and system of a high-voltage direct-current transmission control protection system, and belongs to the technical field of dual-system redundancy. Comprising the following steps: when the operation state of the device is the operation state of a master device, carrying out same-master detection, and when the device and another redundant device are the same master, if the priority of the device is low, switching the operation state of the device from the operation state of the master device to the operation state of a slave device, otherwise, keeping the operation state of the device unchanged; and when the operation state of the device is the operation state of the slave device, carrying out co-slave detection, and when the device and another redundant device are co-slave, if the priority of the device is high, switching the operation state of the device from the operation state of the slave device to the operation state of the master device, otherwise, keeping the operation state of the device unchanged. According to the invention, after the operation state of the redundant device is determined, the corresponding operation under the same master condition or the same slave condition is carried out, so that the same master condition or the same slave condition is avoided.

Description

Technical Field

[0001] The invention relates to a redundant switching method and system for a high-voltage direct current power transmission control and protection system, belonging to the technical field of dual system redundancy. Background Art

[0002] The station control system and pole control system in the high-voltage direct current transmission system are designed according to the dual-system redundancy scheme. The dual systems run simultaneously and obtain relevant information from their respective connected equipment and redundant devices. Only one system operates the controlled object at the same time. The arbitration logic of this operation is realized by two effectively interconnected redundant devices.

[0003] The redundant device generates corresponding arbitration logic output (Active (master) / Passive (slave) signals with positive and negative logic) by performing logical operations on external logic input signals and internal logic signals. When the redundant devices are interconnected and used in a redundant system, the master-slave switching of the two systems is realized by outputting the logic signals "Active" and "Passive", while ensuring the ability of another normal redundant device to arbitrate the status of the dual systems under the condition of a single device (any redundant device) failure. This redundant configuration method of the arbitration mechanism can correspondingly improve the reliability of the entire redundant system.

[0004] The connection diagram of the existing redundant system, such as Figure 1 As shown, system 1 and system 2 are redundantly connected, and two redundant devices (RCD A and RCD B) are interconnected to connect system 1 and system 2. The redundant devices output signals sent by the corresponding systems and output Active (master signal) / Passive (slave signal) with positive and negative logic to achieve master-slave switching between system 1 and system 2.

[0005] like Figure 2 As shown, a cable for transmitting electrical signals is connected between RCD A (RCD100 / 400A in the figure) and RCD B (RCD100 / 400B in the figure), a cable is connected between system A (equivalent to the aforementioned system 1, Control System A in the figure) and RCD A, and a cable is connected between system B (equivalent to the aforementioned system 2, Control System B in the figure) and RCD B. RCD A and RCD B are respectively connected to the host monitoring, power supply monitoring, VBE (electric valve-based electronic equipment) / VCU (optical valve-based electronic equipment), and the control box recording SER through cables. Among them, when RCD400 is selected for the two redundant devices, the two redundant devices are connected to VBE / VCU through optical fibers.

[0006] Among them, the redundant device is referred to as RCD or RCD device. Two RCD devices (RCD A and RCD B) are used to realize the master-slave switching of two redundant systems (system 1 and system 2). The master-slave of the two redundant devices determines the master-slave of the two systems. In the redundant system application, the two RCD devices must cooperate with each other to complete the required master-slave switching task. The two RCD devices are interconnected, and the corresponding digital quantity or digital quantity characteristic signals are logically determined to generate corresponding output signals such as "active" (master signal), "passive" (slave signal), "NO_ESOF" (the inverse logic of the export signal "ESOF") and "ESOF" (export signal, emergency shutdown ESOF signal, used to complete the system shutdown and tripping operation), and the on and off of the "VBE_OK (is the equipment running normally)" and "TRIP (VBE equipment tripping signal)" optical signals form corresponding monitoring alarms and other information.

[0007] Among them, the signals of redundant devices are mainly divided into three types, one is external logic input, including: PS_OK ​​(whether the power supply is running normally), HW_OK (whether the hardware is normal), SW_OK (whether the software is normal), VBE_OK, one is interconnection logic input / output, including: Module_OK (whether the device module is normal), Other_module_OK (whether the module of another device is normal), Maint_Mode_state (switch is prohibited), Passive, Active, Other_ESOF (another device export signal), etc., and the other is arbitration logic output, including: Passive, Active, ESOF, etc. Among them, Passive and Active as a signal pair indicate whether the device is master or slave, specifically:

[0008] Master: Active = '1' and Passive = '0'; Slave: Active = '0' and Passive = '1'; Other combinations are invalid.

[0009] The logic principle of the existing redundant system export signal, such as Figure 3 As shown, the device outputs the device output signal (ESOF, '1' output, '0' no output) according to the logic input signal through the logic operation; the switching logic principle of the existing redundant system switching, such as Figure 4 As shown, the device determines whether the current device is the master or the slave ("system x is the master" is Active, "system x is the slave" is Passive) through logic operation according to the logic input signal.

[0010] The logic signals between the existing RCD devices and between the RCD devices and the redundant system are transmitted through electrical signals, which are susceptible to interference, and the results of logical operations will oscillate, which can easily lead to system malfunctions; among them, due to the relationship between the length and distributed capacitance of the electrical logic signal transmission, the logic signals have different delays (stable "0", "1", may be in a metastable state for a long time), and because some logic signals (electrical signals) in the original software and hardware solutions come from another RCD device, the logic output is unstable, which affects the stable operation of the system; and the reliability of the redundant device and the accuracy of the switching depend on the precise wiring of the hardware circuit and the logic signal transmission path, lacking the necessary verification and other safety measures; and the master-slave determination of the redundant device depends on the logic calculation results of the hardware circuit logic signal, which is very easy to cause the same master or same slave due to errors in the calculation results. Summary of the invention

[0011] The object of the present invention is to provide a redundant switching method and system for a high voltage direct current transmission control and protection system, so as to solve the problem that the existing redundant switching is very likely to cause the same master or same slave due to errors in calculation results.

[0012] To achieve the above object, the solution of the present invention includes:

[0013] A redundant switching method for a high-voltage direct current transmission control and protection system of the present invention comprises: after a redundant device is powered on, arbitrating the operating state of the device according to actual working conditions to be the operating state of the master device or the operating state of the slave device, and further comprising:

[0014] When the running state of the device is the running state of the master device, the same master detection is performed. When the device and another redundant device are the same master, the priorities of the two redundant devices are compared. If the priority of the device is lower, the running state of the device is switched from the running state of the master device to the running state of the slave device. Otherwise, the running state of the device does not change.

[0015] When the operating state of this device is that of a slave device, a same-slave detection is performed. When this device and another redundant device are both slaves, the priorities of the two redundant devices are compared. If the priority of this device is higher, the operating state of this device is switched from the operating state of a slave device to the operating state of a master device. Otherwise, the operating state of this device does not change.

[0016] Furthermore, the method further comprises: when the operation state of the present device is the operation state of the main device, further performing the following step ① or step ②;

[0017] Step ①: When the communication between the two redundant devices is normal and the device fails, determine whether the other redundant device whose operating state is the operating state of the slave device is normal. If so, first switch the operating state of the other redundant device from the operating state of the slave device to the operating state of the master device, and then switch the operating state of the device from the operating state of the master device to the operating state of the slave device. Otherwise, the operating state of the device does not change.

[0018] Step ②: When the communication between the two redundant devices is interrupted, the operating status of this device will not be changed.

[0019] Furthermore, it also includes: when the operation state of the device is the operation state of the slave device, further performing the following step ① or step ②;

[0020] Step ①: When the communication between the two redundant devices is interrupted, the operation state of the device is switched from the operation state of the slave device to the operation state of the master device;

[0021] Step ②: When the communication between the two redundant devices is normal and the manual switch is started, the operating state of the device is switched from the operating state of the slave device to the operating state of the master device through manual switch.

[0022] Furthermore, after the device is powered on, when the operating state of the device is determined to be the operating state of the slave device, check whether the operating state of the master device is in operation. If so, do not change the operating state of the device. Otherwise, check whether there is another redundant device started at the same time. If not, switch the operating state of the device to the operating state of the master device. Otherwise, perform slave detection and execute corresponding operations.

[0023] Furthermore, after the device is powered on, it is checked whether the running state of the master device is in operation. If so, the running state of the device is determined as the running state of the slave device. Otherwise, it is checked whether there is a simultaneous startup device started at the same time. If not, the running state of the device is determined as the running state of the master device. Otherwise, a master-slave arbitration strategy is adopted in which the startup devices are powered on at the same time.

[0024] The master-slave arbitration strategy is to determine the operating state of the two redundant devices according to the priority of the two redundant devices, that is, the operating state of the master device or the operating state of the slave device.

[0025] Furthermore, the priority is determined according to the size of the device IDs of the two redundant devices. The redundant device with a larger device ID has a lower priority, and the redundant device with a smaller device ID has a higher priority.

[0026] Furthermore, the priority is determined according to the device health levels of the two redundant devices. The redundant device with a higher device health level has a higher priority, and the redundant device with a lower device health level has a lower priority.

[0027] A redundant switching system for a high-voltage direct current transmission control and protection system of the present invention comprises a processor, and the processor is used to execute a computer program to implement the steps of the redundant switching method for the high-voltage direct current transmission control and protection system as described above.

[0028] Beneficial effects of the present invention:

[0029] The present invention is an improved invention, and provides a redundant switching method and system for a high-voltage direct current transmission control and protection system. After determining the operating state of a redundant device, a corresponding master-same detection or slave-same detection is performed, and operations in the master-same situation or the slave-same situation are performed to avoid the master-same or slave-same situation caused by an error in the logic calculation result of a hardware circuit logic signal. Specifically, after the redundant device is powered on, the operating state of the device is arbitrated as the operating state of the master device or the operating state of the slave device according to actual working conditions. When the operating state of the device is the operating state of the master device, master-same detection is performed. When the device and another redundant device are the same master, the priorities of the two redundant devices are compared. If the priority of the device is low, the operating state of the device is switched from the operating state of the master device to the operating state of the slave device, otherwise the operating state of the device does not change. When the operating state of the device is the operating state of the slave device, slave-same detection is performed. When the device and another redundant device are the same slave, the priorities of the two redundant devices are compared. If the priority of the device is high, the operating state of the device is switched from the operating state of the slave device to the operating state of the master device, otherwise the operating state of the device does not change.

[0030] Among them, the same master means that the two redundant devices have control rights at the same time and compete for duty; the same slave means that the two systems do not have control rights at the same time and are not on duty. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is the application block diagram of the existing redundant system;

[0032] Figure 2 It is a schematic diagram of the structure of two existing interconnected redundant devices;

[0033] Figure 3 It is a logical principle diagram of the existing redundant system export;

[0034] Figure 4 It is a schematic diagram of the logic principle of the existing redundant system switching;

[0035] Figure 5 is a typical application block diagram of a redundant system according to an embodiment of the present invention;

[0036] Figure 6 It is a block diagram of the arbitration process of the master-slave system when the device of the present invention is powered on;

[0037] Figure 7It is a flowchart of a master-slave switching process of a redundant switching system according to an embodiment of the present invention;

[0038] Figure 8 is another flow chart of master-slave switching of the redundant switching system according to an embodiment of the present invention;

[0039] Fig. 9 It is a schematic diagram of the logic principle of the redundant switching system of an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to solve the problem in the background technology, the present invention provides a redundant switching method and system for a high-voltage direct current transmission control and protection system. After determining the operating state of a redundant device, a corresponding master-slave detection or slave-slave detection is performed, and operations in the master-slave situation or the slave-slave situation are performed to avoid the master-slave or slave-slave situation caused by an error in the logic calculation result of a hardware circuit logic signal. Specifically, after the redundant device is powered on, the operating state of the device is arbitrated as the operating state of the master device or the operating state of the slave device according to the actual working conditions. When the operating state of the device is the operating state of the master device, master-slave detection is performed. When the device and another redundant device are the same master, the priorities of the two redundant devices are compared. If the priority of the device is low, the operating state of the device is switched from the operating state of the master device to the operating state of the slave device, otherwise the operating state of the device does not change. When the operating state of the device is the operating state of the slave device, slave-slave detection is performed. When the device and another redundant device are the same slave, the priorities of the two redundant devices are compared. If the priority of the device is high, the operating state of the device is switched from the operating state of the slave device to the operating state of the master device, otherwise the operating state of the device does not change.

[0041] Among them, the same master means that the two redundant devices have control rights at the same time and compete for duty; the same slave means that the two systems do not have control rights at the same time and are not on duty.

[0042] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0043] An embodiment of a redundant switching method for a high voltage direct current transmission control and protection system:

[0044] A redundant switching method for a high-voltage direct current transmission control and protection system comprises: after a redundant device is powered on, arbitrating the operating state of the device as a master device or a slave device according to actual working conditions.

[0045] When the running state of this device is the running state of the master device, a master-same detection is performed. When this device and another redundant device are the same master, the priorities of the two redundant devices are compared. If the priority of this device is low, the running state of this device is switched from the running state of the master device to the running state of the slave device. Otherwise, the running state of this device does not change.

[0046] When the operating state of this device is that of a slave device, a same-slave detection is performed. When this device and another redundant device are both slaves, the priorities of the two redundant devices are compared. If the priority of this device is higher, the operating state of this device is switched from the operating state of a slave device to the operating state of a master device. Otherwise, the operating state of this device does not change.

[0047] For example: after the redundant device is powered on, the operating status of the device is arbitrated according to the health level of the device (this redundant device). If the health level of the device is higher than that of another redundant device, the operating status of the device is arbitrated as the operating status of the master device; otherwise, the operating status of the device is arbitrated as the operating status of the slave device.

[0048] Specifically, it also includes: when the operation state of the device is the operation state of the main device, the following step ① or step ② is further performed;

[0049] Step ①: Under the premise that the communication between the two redundant devices is normal, when the device fails, determine whether the other redundant device whose operating state is the operating state of the slave device is normal. If so, first switch the operating state of the other redundant device from the operating state of the slave device to the operating state of the master device, and then switch the operating state of the device from the operating state of the master device to the operating state of the slave device. Otherwise, the operating state of the device does not change.

[0050] Step ②: When the line between the two redundant devices is disconnected (ie, the communication between the two redundant devices is interrupted), the operating state of the device is not changed.

[0051] Specifically, it also includes: when the operation state of the device is the operation state of the slave device, further performing the following step ① or step ②;

[0052] Step ①: When the two redundant devices are disconnected, the operation state of the device is switched from the operation state of the slave device to the operation state of the master device;

[0053] Step ②: Under the premise that the communication between the two redundant devices is normal, when the manual switch is started, the operating state of the device is switched from the operating state of the slave device to the operating state of the master device through manual switching.

[0054] Among them, regarding manual switching to switch the operating state of the device from the operating state of the slave device to the operating state of the master device, from the perspective of system stability and safety, for example, when the master system has a minor fault and needs to be repaired, it is necessary to switch the slave to the master, and switch the faulty master to the slave, for repair and replacement, etc. The advantage of allowing the slave system to initiate a switching request (using manual switching) is that the switching request must be allowed by the superior device of the slave device (the superior device comprehensively considers whether the system has serious faults, etc., and determines whether it has the conditions to be the master device), and then forwards the switching request to the master device, and the master device initiates the switching. If the master device allows direct switching, it can switch directly because the master has high authority, but the state of the slave system may be worse, and the result after the switch is more unfavorable to the stable and safe operation of the system.

[0055] Specifically, after the device is powered on, it is checked whether the running state of the master device is in operation, if so, the running state of the device is determined as the running state of the slave device, otherwise it is checked whether there is a simultaneous startup device started at the same time; if not, the running state of the device is determined as the running state of the master device, otherwise the master-slave arbitration strategy of the startup devices being powered on at the same time is adopted;

[0056] The master-slave arbitration strategy is to determine the operating state of the two redundant devices according to the priority of the two redundant devices, that is, the operating state of the master device or the operating state of the slave device.

[0057] Considering that it is unknown whether there is an operating status of the master device in the current redundant system, after the current redundant device is powered on, it is first checked whether the operating status of the master device exists. If it exists, that is, there is a redundant device (another device) on duty, the operating status of the current device is arbitrated as the operating status of the slave device;

[0058] Otherwise, in the case of no master, check whether there is a device started simultaneously. If not, set the operating state of this device to the operating state of the master device to avoid the situation of no master. Otherwise, the master-slave arbitration strategy of starting the devices simultaneously is adopted.

[0059] Among them, the master-slave arbitration strategy for the simultaneous power-on of the devices is as follows: the master and slave of the devices are determined according to the priorities of the two redundant devices, the one with a higher priority is the master, and the one with a lower priority is the slave.

[0060] As another implementation method, after the device is powered on, when the operating state of the device is determined to be the operating state of the slave device, check whether the operating state of the master device is in operation. If so, do not change the operating state of the device. Otherwise, check whether there is another redundant device started at the same time. If not, switch the operating state of the device to the operating state of the master device. Otherwise, perform slave detection and execute corresponding operations.

[0061] In this case, whether there is another redundant device started at the same time can be determined by checking whether there is a simultaneous starting device for powering on two redundant devices at the same time.

[0062] Considering that it is unknown whether there is an operating status of the master device in the current redundant system, after the current redundant device is powered on, the operating status of the device is first arbitrated as the operating status of the slave device, and then the operating status of the master device is checked. If it is, that is, there is a redundant device (another device) on duty, the operating status of the device will not be changed;

[0063] Otherwise, in the case of no master, check whether there is a simultaneous startup device. If not, switch the operating state of this device to the operating state of the master device to avoid the situation of no master. Otherwise, perform slave detection and execute corresponding operations to avoid the operating state of the two redundant devices being the operating state of the slave device (same slave); the simultaneous startup device is used to power on the two redundant devices at the same time.

[0064] Specifically, the priority is determined according to the size of the device IDs of the two redundant devices. The redundant device with a larger device ID has a lower priority, and the redundant device with a smaller device ID has a higher priority.

[0065] As another implementation, the priority is determined according to the device health levels of the two redundant devices. The redundant device with a higher device health level has a higher priority, and the redundant device with a lower device health level has a lower priority.

[0066] like Figure 5 As shown, the redundant system of the present invention is different from the existing redundant system in that two redundant devices, namely RCD_A and RCD_B, are redundantly connected.

[0067] like Figure 6 As shown, the redundant device is powered on, the configuration parameters are loaded, the configuration parameters are initialized, and after waiting for the communication and input signals to be stable, it is determined that the operating state of the device is the operating state of the slave device, and it is checked whether the prohibition of switching is turned on. If so, the switching of the operating state of the device is prohibited. Otherwise, it is checked whether the operating state of the master device exists. If so, the operating state of the device is not changed. Otherwise, it is checked whether there is a simultaneous startup device. If not, the operating state of the device is switched to the operating state of the master device. Otherwise, the priority of the device and the other device is compared. If the priority of the device is higher than that of the other device, the operating state of the device is switched to the operating state of the master device, otherwise no switching is performed.

[0068] The simultaneous start-up device is used to power on two redundant devices at the same time. After the redundant devices are powered on, the operating state of the device is arbitrated as the operating state of the master device or the operating state of the slave device according to the actual working conditions.

[0069] like Figure 7As shown, the operating state of the present device is the operating state of the master device, and it is determined whether the switching request is a forced switching. If so, the operating state of the present device is switched from the operating state of the master device to the operating state of the slave device. Otherwise, it is checked whether the prohibition of switching is turned on. If so, the operating state of the present device does not change. Otherwise, when the present device fails, it is determined whether another device whose operating state is the operating state of the slave device is OK (normal). If so, the operating state of the other device is first switched from the operating state of the slave device to the operating state of the master device, and then the operating state of the present device is switched from the operating state of the master device to the operating state of the slave device. Otherwise, the operating state of the present device does not change.

[0070] When the prohibition switching is not turned on, when this device and another device are both masters, compare the priorities of the two redundant devices. If the priority of this device is low, the operating state of this device is switched from the operating state of the master device to the operating state of the slave device. Otherwise, the operating state of this device does not change. The priority can be determined according to the size of the IDs of the two redundant devices. The larger the ID, the lower the priority, and the smaller the ID, the higher the priority.

[0071] When the prohibition switching is not enabled, when the two redundant devices are disconnected, the operating status of this device will not be changed.

[0072] like Figure 8 As shown, the operating state of the device is the operating state of the slave device, and it is determined whether the switching request is a forced switching. If so, the operating state of the device is switched from the operating state of the slave device to the operating state of the master device. Otherwise, it is checked whether the prohibition of switching is turned on. If so, the operating state of the device does not change. Otherwise, when the two redundant devices are disconnected, the operating state of the device is switched from the operating state of the slave device to the operating state of the master device.

[0073] When the prohibition switching is not turned on, the operating state of the device can be switched from the operating state of the slave device to the operating state of the master device by manual switching.

[0074] When the prohibition switching is not turned on, when this device and another device are both slaves, compare the priorities of the two redundant devices. If the priority of this device is higher, the operating state of this device is switched from the operating state of the slave device to the operating state of the master device. Otherwise, the operating state of this device does not change. The priority can be determined according to the size of the IDs of the two redundant devices. The larger the ID, the lower the priority, and the smaller the ID, the higher the priority.

[0075] like Fig. 9 As shown, the logical principle of the redundant switching system of the present invention includes:

[0076] The redundant switching system of the present invention comprises a redundant device A and a redundant device B. Both the redundant device A and the redundant device B comprise: an inverted normal signal of another device, a slave signal of a corresponding device and a switching prohibition signal are taken as inputs of a first NAND gate, an inverted normal signal of the corresponding device and the switching prohibition signal are taken as inputs of a second NAND gate, an inverted normal signal of the corresponding device, an inverted normal signal of another device and the switching prohibition signal are taken as inputs of a third NAND gate, an output signal of the first NAND gate, an output signal of the second NAND gate and an output signal of the third NAND gate are taken as AND and then inverted to output an exit signal of the corresponding device, and the redundant device A and the redundant device B are connected for communication.

[0077] Among them, the device normal signal includes the output signal of the power normal signal, the hardware normal signal, the software normal signal and the VBE normal signal.

[0078] Specifically, the redundant device A and the redundant device B also have an interface for accepting remote background control, so as to remotely control (including remote prohibition) the corresponding redundant device to perform master-slave switching.

[0079] The present invention provides a system redundancy switching method based on digitization for a high-voltage direct current transmission project, so as to solve the shortcomings of the current traditional analog or analog-digital hybrid redundant system switching device, and can perform logical operations according to input signals and internal signals of the device and generate corresponding logical outputs, and arbitrate whether the control and protection system where the device is located is the master system or the slave system.

[0080] Working principle: The device is powered on to load parameter initialization, wait for communication and input signal to stabilize, and then determine whether the device is the master or slave (the device itself does not set the master or slave, and the master or slave is determined only after entering the system), and then enter the operating state (master or slave).

[0081] During operation, the device communicates with the system control and protection host to receive host information and send its own status information to the control and protection host. The devices exchange device status information at a predetermined period (this information participates in logical operations). The device detects logical input signals such as VBEOK (VBE_OK), power OK, hardware OK, software OK and other signals, detects the status of redundant communication links, detects switching related signals such as manual switching buttons and prohibiting switching buttons, detects abnormal conditions such as being a slave or abnormal being a master, and takes corresponding actions according to the control strategy.

[0082] The present invention has the following functions:

[0083] 1. The redundant device has local and remote prohibition switching functions:

[0084] The redundant device has the function of remotely prohibiting redundant device switching, and accepts remote background control through the remote prohibition switching data port. The background can switch and determine the system operation mode according to the on-site working conditions: 1) The master and slave systems operate normally and can be switched normally; 2) The background issues a prohibition switching command, and the master system operates normally on duty. At this time, switching is prohibited (even if the master system fails), and the slave system can be maintained.

[0085] The redundant device also has a local prohibition switching function, which is executed through the panel buttons. The local prohibition switching function of the redundant device is also executed through the local prohibition switching button to prevent switching when replacing the equipment in the slave system. The remote prohibition switching has the same function as the "local prohibition switching button". The two are logically related. The release of the "prohibition switching" must be released at the same time. The remote prohibition switching can change the operating mode conveniently and timely according to the system operating conditions to avoid potential major accidents.

[0086] 2. The redundant device has the function of automatically arbitrating and determining the master or slave of the system upon power-on:

[0087] After the redundant device is powered on, it automatically determines whether it is the master or slave according to the current working conditions. From power-on to normal operation, the device effectively avoids the occurrence of the same master (the master has control) or the same slave (the slave has no control and is not on duty). It can ensure that in any case, one system is the master (single-machine operation) or one system is the master and the other is the slave (dual-machine operation).

[0088] Same master: The two systems have control rights at the same time and compete for duty; Same slave: The two systems do not have control rights at the same time and neither is on duty.

[0089] 3. The redundant device has the redundant system with the master (abnormal) or slave abnormal processing function:

[0090] The redundant device independently detects whether the system is the master (in case of abnormality) or the slave, and switches in real time to ensure that one system is the master and the other is the slave during operation.

[0091] Same master: When the redundant system does not have the same master normally (during normal switching, there is a short period of same master, which is normal), the device switches to the redundant system with one master and one slave according to the system health or priority (device ID);

[0092] Same slave: When the device detects the same slave, it will immediately switch to the redundant system as one master and one slave according to the system health or priority (ID).

[0093] 4. The redundant device has a forced switching function:

[0094] When the system fails to switch normally due to an abnormality, such as the prohibited switch button sticking, the system cannot switch automatically. The background can be forced to switch to another state through the forced function, from the slave system to the master, and from the master system to the slave, so that the system works in the best state and avoids the system working with problems.

[0095] 5. Redundant devices have a fault-tolerant mechanism for data loss during switching:

[0096] There are frame loss or CRC check errors in the redundant device communication. In order to improve the switching success rate, the redundant device adopts a fault-tolerant mechanism of repeated data frames of important data to reliably ensure that the system accurately switches to the healthy system on duty. Among them, CRC is a cyclic redundancy check code, which is a commonly used check code in the field of computer network communication.

[0097] The redundant system switching is initiated by the master system, which notifies the slave system to switch to the master first, and then notifies the master system that the slave system switching is completed, and the master system then switches to the slave. During the notification process, due to accidental reasons such as communication errors, the notification cannot be delivered, resulting in abnormal switching. To avoid the above situation, multiple continuous calls are used within a certain period of time to ensure reliable delivery of notifications and effectively reduce switching abnormalities.

[0098] 6. Redundant devices have a communication interruption recovery mechanism between devices:

[0099] When communication between redundant devices is interrupted, the best handling strategy is to operate the device alone, that is, both systems are the main system. After communication is restored, the system returns to the state before the communication interruption. This can effectively ensure that there is always a main system on duty.

[0100] 7. The master-slave system works synchronously according to the communication rhythm:

[0101] The master and slave devices respectively process their own logic input signals, signals between another device (between the master and slave devices, between the slave and master devices), and signals between the system (between devices and systems). All signals are sampled and logically operated at the synchronization standard time (the time when communication is initiated), and the output status signal is updated (including transmitting the system status to another system) to avoid differences between different devices, resulting in asynchronous link signals, repeated appearance of some intermediate states, and thus affecting repeated switching of the system.

[0102] 8. Redundant devices have local and remote reconfiguration functions:

[0103] Different application parameters can be configured on-site or remotely in the background according to different application scenarios, which can meet applications such as conventional DC and flexible DC. The device can be used as a standard device for different scenarios, improving the versatility and convenience of equipment maintenance.

[0104] An embodiment of a redundant switching system of a high voltage direct current transmission control and protection system:

[0105] A redundant switching system for a high-voltage direct current transmission control and protection system includes a processor, and the processor is used to execute a computer program to implement the steps of a redundant switching method for a high-voltage direct current transmission control and protection system. The redundant switching method for a high-voltage direct current transmission control and protection system has been described in detail in an embodiment of a redundant switching method for a high-voltage direct current transmission control and protection system, and will not be repeated here.

Claims

1. A redundant switching method for a high voltage direct current transmission control and protection system, comprising: After the redundant device is powered on, the operating state of the device is arbitrated according to the actual working conditions to be the operating state of the master device or the operating state of the slave device, and is characterized in that it also includes: When the running state of the device is the running state of the master device, the same master detection is performed. When the device and another redundant device are the same master, the priorities of the two redundant devices are compared. If the priority of the device is lower, the running state of the device is switched from the running state of the master device to the running state of the slave device. Otherwise, the running state of the device does not change. When the operating state of this device is that of a slave device, a same-slave detection is performed. When this device and another redundant device are both slaves, the priorities of the two redundant devices are compared. If the priority of this device is higher, the operating state of this device is switched from the operating state of a slave device to the operating state of a master device. Otherwise, the operating state of this device does not change.

2. The redundant switching method of the high voltage direct current transmission control and protection system according to claim 1, characterized in that: Also includes: When the operation state of the present device is the operation state of the main device, the following step ① or step ② is also performed; Step ①: When the communication between the two redundant devices is normal and the device fails, determine whether the other redundant device whose operating state is the operating state of the slave device is normal. If so, first switch the operating state of the other redundant device from the operating state of the slave device to the operating state of the master device, and then switch the operating state of the device from the operating state of the master device to the operating state of the slave device. Otherwise, the operating state of the device does not change. Step ②: When the communication between the two redundant devices is interrupted, the operating status of this device will not be changed.

3. The redundant switching method of the high voltage direct current transmission control and protection system according to claim 1, characterized in that: Also includes: When the operation state of the device is the operation state of the slave device, the following step ① or step ② is also performed; Step ①: When the communication between the two redundant devices is interrupted, the operation state of the device is switched from the operation state of the slave device to the operation state of the master device; Step ②: When the communication between the two redundant devices is normal and the manual switch is started, the operating state of the device is switched from the operating state of the slave device to the operating state of the master device through manual switch.

4. The redundant switching method of the high voltage direct current transmission control and protection system according to claim 1, characterized in that: After the device is powered on, when the operating state of the device is determined to be the operating state of the slave device, check whether the operating state of the master device is in operation. If so, do not change the operating state of the device. Otherwise, check whether there is another redundant device started at the same time. If not, switch the operating state of the device to the operating state of the master device. Otherwise, perform slave detection and execute corresponding operations.

5. The redundant switching method of the high voltage direct current transmission control and protection system according to claim 1, characterized in that: After the device is powered on, check whether the running state of the master device is in operation, if so, determine the running state of the device as the running state of the slave device, otherwise check whether there is a simultaneous startup device; if not, determine the running state of the device as the running state of the master device, otherwise start the master-slave arbitration strategy of the devices being powered on simultaneously; The master-slave arbitration strategy is to determine the operating state of the two redundant devices according to the priority of the two redundant devices, that is, the operating state of the master device or the operating state of the slave device.

6. The redundant switching method of the high voltage direct current transmission control and protection system according to claim 1, characterized in that: The priority is determined according to the size of the device IDs of the two redundant devices. The redundant device with a larger device ID has a lower priority, and the redundant device with a smaller device ID has a higher priority.

7. The redundant switching method of the high voltage direct current transmission control and protection system according to claim 1, characterized in that: The priority is determined according to the device health levels of the two redundant devices. The redundant device with a higher device health level has a higher priority, and the redundant device with a lower device health level has a lower priority.

8. A redundant switching system for a high voltage direct current transmission control and protection system, comprising a processor, characterized in that: The processor is used to execute a computer program to implement the steps of the redundant switching method of the high-voltage direct current transmission control and protection system according to any one of claims 1 to 7.

Images