Safety recovery method for abnormal restart control state of gas turbine monitoring terminal

Abstract

The invention discloses a gas turbine monitoring terminal abnormal restart control state safety recovery method, which comprises the following steps that a dual-redundancy monitoring terminal system is constructed, the dual-redundancy monitoring terminal system comprises a main monitoring terminal and a standby monitoring terminal, hardware of the main monitoring terminal and hardware of the standby monitoring terminal are independent and run in parallel, and a main-standby relation is determined through a preset priority and a dynamic verification mechanism; when the main monitoring terminal is abnormal, the standby monitoring terminal takes over a control task within millisecond and executes main and standby state synchronization and lower computer data synchronization; after the main monitoring terminal is abnormally restarted, performing state synchronization with the new main terminal and the lower computer, and forbidding to output a control instruction in an initial period; when the standby monitoring terminal is abnormal, the standby monitoring terminal is independently restarted and performs state synchronization with the main monitoring terminal and the lower computer, and output of a control instruction is forbidden in an initial initialization period; when the main and standby monitoring terminals fail at the same time, an emergency restart process is started, and the main terminal takes over and controls after global state synchronization is completed; the reliability and safety of the whole control system are improved.

Description

Technical Field

[0001] This invention relates to the field of gas turbine monitoring technology, and specifically to a method for safely restoring the control state of a gas turbine monitoring terminal in case of an abnormal restart. Background Technology

[0002] As critical software for high safety, gas turbine control software must not experience a decline in operational status due to software restarts. An abnormal decrease in engine operating conditions can lead to insufficient output power, affecting power generation, propulsion, or drive capability. Speed ​​fluctuations caused by this decline increase the risk of mechanical damage, such as compressor surge. Severe mechanical damage can also threaten equipment and personnel. The gas turbine control system consists of a control cabinet and a gas turbine monitoring terminal, among other components. Whether in civil power generation or marine propulsion systems, the gas turbine requires long-term safe operation. The normal operation of the control software also depends on the normal input from the gas turbine monitoring terminal. An abnormal restart or input from the gas turbine monitoring terminal will also affect the control software. Summary of the Invention

[0003] Purpose of the invention: The purpose of this invention is to provide a method for safely restoring the control state of a gas turbine monitoring terminal in the event of an abnormal restart. This method addresses the scenario of an abnormal restart of the gas turbine monitoring terminal and analyzes the gas turbine monitoring terminal and gas turbine control software to solve the problems existing in the background technology.

[0004] Technical Solution: The present invention provides a method for safe recovery of control status after abnormal restart of a gas turbine monitoring terminal, comprising the following steps: constructing a dual-redundant monitoring terminal system, including a primary monitoring terminal and a backup monitoring terminal, both operating independently and in parallel, with their primary / backup relationship determined by a preset priority and dynamic verification mechanism; when the primary monitoring terminal malfunctions, the backup monitoring terminal takes over the control task within milliseconds and performs primary / backup status synchronization and lower-level machine data synchronization; after the primary monitoring terminal restarts abnormally, it synchronizes its status with the new primary terminal and lower-level machine, and prohibits the output of control commands during the first initialization cycle; when the backup monitoring terminal malfunctions, it restarts independently and synchronizes its status with the primary monitoring terminal and lower-level machine, prohibiting the output of control commands during the first initialization cycle; when both the primary and backup monitoring terminals fail simultaneously, an emergency restart process is initiated, and after global status synchronization is completed, the primary terminal takes over control.

[0005] Furthermore, the dual-redundant monitoring terminal system uses completely independent hardware devices, including independent CPUs, data acquisition modules, communication interface cards, and power supply modules.

[0006] Furthermore, the primary / standby determination mechanism is as follows: in the initial state, the primary / standby relationship is set through system parameter configuration; the standby monitoring terminal periodically sends status query signals to the primary monitoring terminal; if the primary monitoring terminal fails to respond multiple times consecutively or the parameter error exceeds the threshold, a primary / standby switchover is triggered.

[0007] Furthermore, the master / slave switchover process is as follows: the standby monitoring terminal continues to control the actuator based on the control command of the last synchronization; during the switchover process, the status flag of the monitoring interface is updated, and communication with the host computer is maintained without interruption.

[0008] Furthermore, status synchronization includes: control status synchronization: synchronizing the current control strategy, alarm threshold, and operating mode to another terminal; lower-level machine data synchronization: acquiring real-time parameters from the lower-level machine through the communication bus and verifying and correcting them with the terminal cached parameters.

[0009] Furthermore, the initial initial cycle is set to 5 seconds, during which the terminal only performs self-test, data loading and synchronization operations, and does not output any control commands.

[0010] Furthermore, the emergency restart process involves an independent emergency monitoring module detecting the status of the primary and backup terminals and triggering a synchronous restart; after restarting, the primary and backup relationship is redefined according to the preset priority; after completing the global status synchronization between terminals and between terminals and lower-level machines, the primary terminal takes over control.

[0011] The present invention provides a safe recovery system for the abnormal restart control state of a gas turbine monitoring terminal, comprising: Dual-redundant monitoring terminal module: used to build a dual-redundant monitoring terminal system, including a primary monitoring terminal and a backup monitoring terminal. The two are hardware-independent and run in parallel, and the primary / backup relationship is determined by a preset priority and dynamic verification mechanism. Monitoring terminal anomaly module: When the main monitoring terminal malfunctions, the backup monitoring terminal takes over the control tasks within milliseconds and performs main / backup status synchronization and lower-level machine data synchronization. Status synchronization module: used to synchronize the status with the new master terminal and slave device after the master monitoring terminal restarts abnormally, and to prohibit the output of control commands during the first initialization cycle; Backup monitoring terminal failure module: When the backup monitoring terminal fails, it can be restarted independently and its status synchronized with the main monitoring terminal and the lower-level machine. During the initial initialization cycle, it is prohibited from outputting control commands. Emergency restart module: When both the primary and backup monitoring terminals fail simultaneously, an emergency restart process is initiated, and after global status synchronization is completed, the primary terminal takes over control.

[0012] An electronic device according to the present invention includes a memory and a processor. The memory stores a computer program, and the processor executes the program to implement the steps of the method.

[0013] The present invention discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method.

[0014] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages: The present invention supports abnormal recovery control of all gas turbine monitoring terminals; users can configure the synchronous mapping relationship; the lower-level machine supports real-time synchronous information uploading; the upper-level machine supports data recovery and transmission capability after abnormal restart; and ensures the long-term safe operation of the gas turbine control system. Attached Figure Description

[0015] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0016] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0017] like Figure 1 As shown in the figure, this invention provides a method for safely restoring the control state of a gas turbine monitoring terminal in case of an abnormal restart, including the following steps: Step 1: Constructing a Dual-Redundant Monitoring Terminal System: The core design of a dual-redundant monitoring terminal system lies in "hardware independence + logical coordination," requiring the establishment of a basic framework from three dimensions: hardware selection, operational logic, and primary / backup determination. Firstly, in terms of hardware configuration, the two monitoring terminals must use completely independent hardware devices, including independent central processing units (CPUs), data acquisition modules, communication interface cards, and power supply modules. This avoids the risk of "all failing if one fails" due to shared hardware components. For example, the primary terminal uses an industrial-grade quad-core processor to ensure data processing speed, while the backup terminal uses the same model processor to ensure consistent processing power. Simultaneously, both are connected to different power supply circuits: the primary terminal connects to the main power supply, and the backup terminal connects to a UPS backup power supply, further enhancing hardware redundancy.

[0018] In terms of operational logic, the two sets of terminals need to achieve "real-time parallel operation" rather than the traditional "master operation, backup standby" mode. After the system is powered on, the master and backup monitoring terminals will simultaneously start the gas turbine monitoring program, synchronously collect key operating parameters of the unit such as speed, temperature, pressure, and vibration, and achieve data interaction through the internal high-speed communication bus (such as EtherCAT or Profinet) to ensure that the parameters acquired by the two are completely consistent.

[0019] The primary / standby determination mechanism employs a combination of "preset priority + dynamic verification." Initially, system parameters configure one terminal as the "primary monitoring terminal" and the other as the "standby monitoring terminal." The primary terminal defaults to handling core control tasks, including issuing control commands to gas turbine actuators (such as fuel regulating valves and intake guide vanes), displaying real-time operating data on the monitoring interface, and triggering alarm signals. The standby terminal is in "hot standby" mode, only synchronously receiving data and commands without actively outputting control signals. However, it verifies the primary terminal's operating status in real time—sending a status query signal to the primary terminal every 100ms. The primary terminal must respond normally within 50ms. If no valid feedback is received three consecutive times, or if the parameter acquisition error of the primary terminal exceeds a threshold (e.g., temperature acquisition deviation > 2℃), a re-determination of the primary / standby status is triggered. However, in the absence of abnormalities, the primary monitoring terminal is always prioritized for control tasks, ensuring system stability and consistency.

[0020] Step 2: Switching and Status Synchronization in Case of Main Monitoring Terminal Anomaly: When the main monitoring terminal malfunctions (e.g., CPU crash, data acquisition module failure, communication interruption), the system must complete the main / backup switch within milliseconds while ensuring status synchronization to prevent fluctuations in gas turbine operation. The fault identification process is jointly completed by the backup terminal and the system monitoring module: Upon detecting a lack of response or abnormal parameters in the main terminal through real-time verification, the backup terminal immediately sends a "main terminal anomaly" signal to the system monitoring module. The system monitoring module then further checks the hardware status of the main terminal (e.g., power supply voltage, module indicator lights) and software logs to rule out misjudgments such as temporary communication interference. If a fault is confirmed in the main terminal, a "main / backup switch" command will be issued within 100ms.

[0021] The switchover process employs a seamless takeover mode, ensuring no impact on gas turbine operation. Upon receiving the switchover command, the standby terminal immediately switches from "hot standby" to "master control," taking over all control tasks. Firstly, based on the previously synchronized storage of the last control command issued by the master terminal, it continues to send commands with the same parameters to the actuators, preventing command interruptions that could cause fluctuations in unit speed and load. Secondly, it updates the master / standby status indicator on the monitoring interface, alerting maintenance personnel that the master terminal is malfunctioning, while maintaining normal communication with the host computer (such as the central control room monitoring system) to ensure uninterrupted access to operational data. The entire switchover process takes no more than 200ms, far less than the gas turbine's dynamic response time (typically >1s), fully guaranteeing normal unit operation without downtime or load reduction.

[0022] Status synchronization is a crucial step in ensuring system consistency after a switchover, requiring bidirectional synchronization of "master / standby control status + lower-level machine data." First, the standby terminal (the new master terminal) synchronizes its control status (such as the currently executed control strategy, alarm thresholds, and operating mode) to the faulty master terminal (now the standby terminal) in real time, ensuring complete consistency in their control logic. Second, the new master terminal performs data verification with the lower-level machines of the gas turbine (such as field control units and sensor acquisition modules) via the communication bus, comparing its stored parameters with the parameters uploaded in real time by the lower-level machines. If discrepancies exist (such as minor discrepancies due to data transmission delays during the switchover), the actual data from the lower-level machines is used as the standard, updating the master terminal's parameter cache to ensure complete synchronization between the monitoring terminal and the lower-level machines, preparing for the subsequent recovery of the faulty master terminal.

[0023] Step 3: Reboot and Status Recovery After Main Monitoring Terminal Anomaly: After the main monitoring terminal malfunctions and completes the master-slave switchover, a reboot recovery process must be initiated to ensure the stable operation of the new main terminal (original backup terminal) and prevent secondary failures. First, the system will automatically trigger a reboot operation on the main terminal—if the main terminal experiences a software failure (such as a program crash), a reboot command will be sent remotely to restart the embedded operating system and monitoring program; if it is a temporary hardware failure (such as poor module contact), the main terminal power will be cut off for 10 seconds and then powered on again to complete a hardware reset. During the reboot process, the original backup terminal (new main terminal) will continue to perform control tasks unaffected by the reboot operation, ensuring the normal operation of the gas turbine.

[0024] After restarting, the master terminal (now the backup terminal) needs to complete state synchronization in two steps: The first step is to synchronize with the new master terminal. After restarting, the new backup terminal (the original master terminal) will immediately send a "state synchronization request" to the new master terminal. The new master terminal will then transmit the current control parameters (such as fuel flow setpoint, intake guide vane opening, alarm records), operating modes (such as start mode, normal operation mode, and shutdown mode), and lower-level machine communication status to the new backup terminal via the high-speed bus. After receiving the data, the new backup terminal will verify the integrity of each piece of data. If the data is correct, it will be stored in the local cache to ensure that the control logic and operating status are completely consistent with the new master terminal. The second step is to restore the state synchronization with the lower-level machine. The new standby terminal will proactively send data acquisition requests to the lower-level machine to obtain the current real-time operating parameters of the gas turbine (such as rotor speed, combustion chamber temperature, and exhaust pressure), and compare them with the parameters synchronized with the new master terminal. If the deviation is within the allowable range (such as speed deviation < 50 r / min), the synchronization is completed; if the deviation exceeds the threshold, the terminal will use the average value of the parameters of the new master terminal and the lower-level machine as the benchmark to correct its own parameters and ensure that the three are in the same state.

[0025] It is particularly important to note that during the initial initialization cycle of the gas turbine monitoring terminal (whether it is the main terminal or the backup terminal after a restart), the rule of "only restoring the status, not outputting commands" must be strictly followed. The initial initialization cycle is set to 5 seconds. During this period, the terminal only performs hardware self-checks, software loading, and data synchronization. Even if some abnormal parameters are detected, no control commands will be issued to the actuators. This is because the terminal's parameter cache may not be fully synchronized in the early stages of startup. If commands are blindly output, it may cause the actuators to malfunction, leading to risks such as sudden increases or decreases in gas turbine speed and load fluctuations. After the 5-second initialization cycle ends and the terminal confirms that its status is completely consistent with the new main terminal and the slave device, it will enter the normal "hot standby" state, ready to take over control tasks at any time in case of an anomaly in the new main terminal.

[0026] Step 4: Independent Handling and Status Recovery After Backup Monitoring Terminal Anomaly: Unlike the main monitoring terminal anomaly, when the backup monitoring terminal fails, the main monitoring terminal continues to operate normally. Therefore, the core of the handling is "independent restart + no impact on unit operation". First, fault identification is jointly completed by the main terminal and the system monitoring module: If the main terminal does not receive status feedback from the backup terminal three consecutive times during real-time communication with the backup terminal, or detects obvious errors in the parameters uploaded by the backup terminal (such as a negative pressure value), it will immediately send a "backup terminal anomaly" signal to the system monitoring module. After verification, the system monitoring module confirms the backup terminal failure. At this time, no main / backup switch will be triggered (because the main terminal is normal), and only a "backup terminal restart" command will be issued. Throughout the process, the main terminal continues to perform control tasks, and the operation of the gas turbine is not disturbed in any way, avoiding system fluctuations caused by the backup terminal failure.

[0027] The restart operation of the backup terminal is divided into two cases: automatic restart and manual restart. If the fault log shows a software fault (such as program deadlock or memory overflow), the system will automatically perform a remote restart. The restart process is similar to that of the main terminal: first, close the monitoring program, and then restart the operating system. If the fault is a hardware fault (such as communication module damage or power module failure), after the automatic restart fails, the system will send an alarm message to the maintenance personnel, prompting them to perform manual repair. After the hardware fault is resolved, the maintenance personnel will manually trigger the restart operation.

[0028] After restarting, the standby terminal needs to quickly complete dual-state synchronization to re-enter "hot standby" mode. The first step is to synchronize the status with the primary monitoring terminal: After restarting, the standby terminal will actively connect to the primary terminal and request core information such as current control parameters, operating mode, and alarm records. The primary terminal will transmit data in batches in the form of data packets. After receiving the data, the standby terminal will verify each field to ensure that the control logic is completely consistent with that of the primary terminal. For example, if the primary terminal currently sets the rated speed of the gas turbine to 3000 r / min, the standby terminal must also set the speed threshold to 3000 r / min after synchronization to avoid parameter mismatch during subsequent switching. The second step is to restore the status synchronization with the lower-level machine: The standby terminal sends a parameter acquisition command to the lower-level machine to obtain the current real-time operating data of the unit and compares it with the parameters synchronized with the primary terminal. If there is a discrepancy, the parameters of the primary terminal and the lower-level machine will be used for correction to ensure that the parameter cache of the standby terminal is consistent with the actual operating status.

[0029] Similarly, during the initial 5-second initialization cycle of the standby terminal, the rule of "not executing instruction output" must be strictly followed. During initialization, the standby terminal only performs self-checks and data synchronization. Even if abnormal parameters are detected in the master terminal or lower-level machine, it will not actively intervene in the control process. Only after synchronization is completed and the status is confirmed to be correct will it enter the "hot standby" state, monitor the operation of the master terminal in real time, and prepare for possible master-slave switching in the future.

[0030] Step 5: Emergency Restart and Global Synchronization in Case of Simultaneous Failure of Primary and Backup Monitoring Terminals: Simultaneous failure of the primary and backup monitoring terminals is an extreme but critical scenario requiring careful prevention. In this case, an emergency restart procedure must be initiated to ensure the gas turbine does not shut down due to monitoring interruption. First, fault identification is performed by the system's emergency monitoring module (a hardware module independent of the primary and backup terminals). The emergency monitoring module connects to the primary and backup terminals via an independent communication interface. If it detects simultaneous unresponsiveness, abnormal parameters, or hardware failure in both terminals, it immediately triggers a "global fault alarm." On one hand, it sends an emergency alarm signal to the central control room to alert maintenance personnel; on the other hand, it automatically initiates the emergency restart procedure to prevent the fault from persisting and causing the unit to become uncontrollable.

[0031] Emergency restart employs a "synchronous restart + priority determination" approach. The emergency monitoring module simultaneously sends restart commands to both primary and backup terminals, ensuring they start at the same time and avoiding parameter asynchrony caused by startup time differences. During the restart process, each terminal first performs a hardware self-test (such as CPU, memory, and communication module status checks). If the self-test passes, the monitoring program is loaded. If one terminal fails its self-test (e.g., hardware failure), the other terminal automatically becomes the "temporary primary terminal," prioritizing startup and taking over control tasks. If both terminals pass their self-tests, the primary and backup terminals are re-determined according to a preset priority (consistent with the initial primary / backup determination), ensuring the system has a clear control core after restart.

[0032] Global synchronization after restarting is crucial for ensuring the system returns to normal operation, requiring dual verification of "synchronization between terminals + synchronization between terminals and lower-level machines." The first step is monitoring the status synchronization between terminals: after the primary and backup terminals start up, they transmit information such as hardware status, software version, and parameter cache through a temporary communication channel established by the emergency monitoring module. If parameter differences are found (e.g., different alarm thresholds), they are corrected based on preset standard parameters to ensure complete consistency in control logic. The second step is restoring the status synchronization between terminals and lower-level machines: the primary terminal sends a full parameter acquisition command to the lower-level machine to obtain all operating parameters of the gas turbine, such as current speed, temperature, and pressure, and synchronizes these parameters to the backup terminal. Simultaneously, it compares the last set of parameters stored before restarting with the current lower-level machine parameters. If the deviation is within acceptable limits, control commands are issued based on the current parameters. If the deviation is large (e.g., speed deviation > 100 r / min), the primary terminal first issues a "frequency and voltage stabilization" command to ensure stable unit operation before gradually adjusting parameters to the normal range.

[0033] Consistent with other startup scenarios, during the initial 5-second initialization period after an emergency restart of the primary and backup terminals, the rule of "restoring status only, without outputting commands" must be strictly followed. During initialization, the terminal only performs self-checks, data synchronization, and parameter verification, without issuing any control commands to the actuators. This is because if both the primary and backup terminals fail simultaneously, the lower-level machine may have stored some temporary data. If the terminal blindly outputs commands, it may conflict with the temporary data of the lower-level machine, leading to malfunctions of the actuators. Only after the 5-second initialization period ends and the terminal confirms that its status is completely consistent with other terminals and lower-level machines will the primary terminal officially take over the control tasks, restoring normal monitoring and control of the gas turbine. This ensures the entire emergency recovery process is safe and stable, minimizing the impact of the failure on the unit's operation.

Claims

1. A method for safely restoring the control state of a gas turbine monitoring terminal after an abnormal restart, characterized in that, Includes the following steps: A dual-redundant monitoring terminal system is constructed, including a primary monitoring terminal and a backup monitoring terminal. The two terminals operate independently and in parallel, with their primary / backup relationship determined by a preset priority and dynamic verification mechanism. When the primary monitoring terminal malfunctions, the backup monitoring terminal takes over control tasks within milliseconds and performs primary / backup status synchronization and lower-level machine data synchronization. After the primary monitoring terminal restarts abnormally, it synchronizes its status with the new primary terminal and lower-level machines, and prohibits the output of control commands during the first initialization cycle. When the backup monitoring terminal malfunctions, it restarts independently and synchronizes its status with the primary monitoring terminal and lower-level machines, prohibiting the output of control commands during the first initialization cycle. When both the primary and backup monitoring terminals fail simultaneously, an emergency restart process is initiated, and after completing global status synchronization, the primary terminal takes over control.

2. The method for safely restoring the control state of a gas turbine monitoring terminal after an abnormal restart, as described in claim 1, is characterized in that... The dual-redundant monitoring terminal system uses completely independent hardware devices, including independent CPUs, data acquisition modules, communication interface cards, and power supply modules.

3. The method for safely restoring the control state of a gas turbine monitoring terminal after an abnormal restart, as described in claim 1, is characterized in that... The primary / standby determination mechanism is as follows: the primary / standby relationship is set through system parameter configuration in the initial state; the standby monitoring terminal periodically sends status query signals to the primary monitoring terminal; if the primary monitoring terminal fails to respond multiple times consecutively or the parameter error exceeds the threshold, the primary / standby switchover is triggered.

4. The method for safely restoring the control state of a gas turbine monitoring terminal after an abnormal restart, as described in claim 1, is characterized in that... The master / slave switchover process is as follows: The standby monitoring terminal continues to control the actuator based on the control command of the last synchronization; during the switchover process, the status flag of the monitoring interface is updated, and communication with the host computer is maintained without interruption.

5. The method for safely restoring the control state of a gas turbine monitoring terminal after an abnormal restart, as described in claim 1, is characterized in that... Status synchronization includes: control status synchronization: synchronizing the current control strategy, alarm threshold, and operating mode to another terminal; lower-level machine data synchronization: acquiring real-time parameters from the lower-level machine through the communication bus and verifying and correcting them with the terminal cached parameters.

6. The method for safely restoring the control state of a gas turbine monitoring terminal after an abnormal restart, as described in claim 1, is characterized in that... The initial cycle is set to 5 seconds. During this period, the terminal only performs self-test, data loading and synchronization operations, and does not output any control commands.

7. The method for safely restoring the control state of a gas turbine monitoring terminal after an abnormal restart, as described in claim 1, is characterized in that... The emergency restart process involves an independent emergency monitoring module detecting the status of the primary and backup terminals and triggering a synchronous restart. After restarting, the primary and backup relationships are redefined according to preset priorities. After completing the global status synchronization between terminals and between terminals and lower-level machines, the primary terminal takes over control.

8. A system for safely restoring the control state of a gas turbine monitoring terminal in case of abnormal restart, characterized in that, include: Dual-redundant monitoring terminal module: used to build a dual-redundant monitoring terminal system, including a primary monitoring terminal and a backup monitoring terminal. The two are hardware-independent and run in parallel, and the primary / backup relationship is determined by a preset priority and dynamic verification mechanism. Monitoring terminal anomaly module: When the main monitoring terminal malfunctions, the backup monitoring terminal takes over the control tasks within milliseconds and performs main / backup status synchronization and lower-level machine data synchronization. Status synchronization module: used to synchronize the status with the new master terminal and slave device after the master monitoring terminal restarts abnormally, and to prohibit the output of control commands during the first initialization cycle; Backup monitoring terminal failure module: When the backup monitoring terminal fails, it can be restarted independently and its status synchronized with the main monitoring terminal and the lower-level machine. During the initial initialization cycle, it is prohibited from outputting control commands. Emergency restart module: When both the primary and backup monitoring terminals fail simultaneously, an emergency restart process is initiated, and after global status synchronization is completed, the primary terminal takes over control.

9. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program, and the processor executing the program to implement the steps of the method according to claims 1-6.

10. A computer-readable storage medium, characterized in that, The device contains a computer program that, when executed by a processor, implements the steps of the method described in claims 1-6.

Images