Protection control system and protection control method

Abstract

To prevent an unnecessary operation due to a single failure in one aggregated IED.SOLUTION: A protection control system includes: a protection control device; and a MU. The protection control device includes: a calculation unit including a plurality of cores; and a memory. An input and output processing unit executed by a first core writes data for first and second detection elements received from the MU into first and second regions of the memory, respectively. A first protection control processing unit executed by a second core executes a protection control calculation on the basis of the data for the first detection element written in the first region, and outputs first protection control data containing the result of the calculation. A second control processing unit executed by a third core executes a protection control calculation on the basis of the second detection element written in the second region, and outputs a second protection control data containing the result of the calculation. The MU outputs an operation command to a device for protection control on the basis of the first and second protection control data.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a system configuration technology for a digital protection and control device equipped with multiple calculation processors, and in particular to an integrated digital protection and control device and system that prevents unnecessary operation due to a single component defect. [Background technology]

[0002] Protection devices installed in each element of the power system, such as transmission lines, busbars, transformers, and generators, are used to remove faults such as short circuits and earth faults that occur in these elements. They operate in the event of a fault occurring within their range of protection, and the section of the power system containing the fault is isolated by a circuit breaker.

[0003] Currently, voltage and current signals that indicate the system state are taken in and converted to digital values, and then system faults are identified through software processing using digital calculation functions.For this reason, since the protection device does not tolerate unnecessary operation due to a single hardware fault, the main detection (M element) and fault detection (Fault Detect: FD element) are each configured as separate hardware, and the final output is determined by the AND condition of each output.

[0004] In the current device configuration, the main detection element and the accident detection element are each configured as separate hardware, with each calculation unit mounted on a separate board (separate hardware).

[0005] Furthermore, when configuring a protection and control system using overseas specification products that do not have the function of accident detection elements, it is necessary to configure two protection and control devices, each with its own main detection element and accident detection element, which poses challenges in terms of cost and space.

[0006] For this reason, Non-Patent Documents 1 and 2 incorporate the concept of soft FD, which implements the AND conditions of the main detection elements and the fault detection elements through software processing based on past operational results, and implements it in one piece of hardware. In other words, it is configured to execute the calculation processing of the protective relay with a single calculation function (CPU).

[0007] Furthermore, in Patent Document 1, when integrating protective relay functions and monitoring and control functions, a protective and control system is configured in such a way that two calculation functions consisting of multiple components are implemented within the hardware, so that a failure of one function or a failure of a shared part does not affect the function of the other.

[0008] The CPU calculation function is implemented with two circuits' worth of calculation functions (two CPUs' worth), including memory, to ensure reliability. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] JP 2012-279426 A [Non-patent literature]

[0010] [Non-Patent Document 1] Power Standard B-402 Digital Protection Relays and Digital Protection Relay Devices [Non-Patent Document 2] Institute of Electrical Engineers of Japan Protection Relay System Study Group PPR-21-011 "Development and application of an integrated busbar isolation relay device using IEDs that can be used for both trunk and local systems" Summary of the Invention [Problem to be solved by the invention]

[0011] If an abnormality occurs inside the protection and control device, unless the running program is stopped, it may lead to unnecessary operation depending on the situation. For this reason, protection and control functions have traditionally been implemented with main detection and accident detection functions in separate hardware to prevent malfunction, and major calculation functions, including the CPU, are configured with redundancy. This requires separate hardware for the main detection and accident detection functions, which creates a cost issue.

[0012] In addition, although configuring the main detection and accident detection functions with software makes it possible to prevent malfunctions functionally, the possibility of malfunctions occurring if an unexpected component defect occurs cannot be denied.

[0013] When trying to reduce size and cost by using an integrated protection and control device that consolidates protection and control functions in a single device, a solution is needed that reduces cost while maintaining functional redundancy. [Means for solving the problem]

[0014] In order to solve at least one of the above problems, the present invention provides a protection and control system having a protection control device and a merging unit, wherein the protection control device has an arithmetic unit including a plurality of processor cores and a memory, and an input / output processing unit executed by a first processor core among the plurality of processor cores writes data of a first detection element and data of a second detection element among data received from the merging unit into a first area and a second area of ​​the memory, respectively, a first protection and control processing unit executed by a second processor core among the plurality of processor cores performs a protection and control calculation based on the data of the first detection element written in the first area and outputs first protection and control data including the result, a second protection and control processing unit executed by a third processor core among the plurality of processor cores performs a protection and control calculation based on the data of the second detection element written in the second area and outputs second protection and control data including the result, and the merging unit outputs an operation command for a device for protection and control based on the first protection and control data and the second protection and control data. Effect of the Invention

[0015] According to one aspect of the present invention, even if a single component failure or program error occurs, the main detection and accident detection protection control units can be prevented from simultaneously failing, thereby preventing unnecessary operation even in a single centralized IED, thereby ensuring reliability without the need for a redundant hardware configuration and reducing costs.

[0016] Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0017] [Figure 1] FIG. 1 is a block diagram showing an example of a configuration of an aggregated IED and protection control system according to a first embodiment of the present invention. [Diagram 2] 2 is a functional block diagram showing an example of the internal configuration of an MU according to the first embodiment of the present invention. FIG. [Diagram 3] FIG. 2 is an explanatory diagram showing an example of an operation until the IED according to the first embodiment of the present invention stores the captured sample value. [Figure 4] FIG. 2 is an explanatory diagram showing an example of a data format of sample value data issued by an MU according to the first embodiment of the present invention. [Diagram 5] FIG. 2 is a block diagram showing an example of a software configuration of an IED according to a first embodiment of the present invention. [Figure 6] FIG. 4 is an explanatory diagram showing an example of an operation when each processing unit accesses a physical address in the first embodiment of the present invention. [Figure 7] 1 is a flowchart illustrating an example of a memory protection operation executed by the IED according to the first embodiment of the present invention. [Figure 8] 1 is an explanatory diagram showing an example of an operation performed by the IED according to the first embodiment of the present invention after a protection calculation; [Figure 9] FIG. 2 is an explanatory diagram illustrating an example of a frame configuration of a data frame in the first embodiment of the present invention. [Figure 10] FIG. 2 is an explanatory diagram showing an example of operation based on the M element and the FD element of the IED and MU according to the first embodiment of the present invention. [Figure 11] FIG. 11 is an explanatory diagram showing an example of operation based on the M element and the FD element of the IED and MU according to the second embodiment of the present invention. [Figure 12] FIG. 11 is a block diagram showing an example of a software configuration of an IED according to a third embodiment of the present invention. [Figure 13] FIG. 11 is an explanatory diagram showing an example of the configuration of a memory management unit for converting a virtual address of a memory into a physical address in the third embodiment of the present invention. [Figure 14] FIG. 11 is an explanatory diagram showing an example of an operation when each processing unit accesses a physical address in the third embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] First, an outline of an embodiment of the present invention will be described. In the embodiment of the present invention, in an integrated protection and control device (hereinafter referred to as an integrated IED) that implements multiple CPU processing cores to realize multiple protection and control functions, the protection and control function of the main detection element and the protection and control function of the accident detection element (FD element) are assigned to independent CPU processing cores, and the memory, which is a shared resource, is virtualized and logically separated, and the memory is physically protected by an ECC protection function so that the main detection element and the FD element do not affect each other.

[0019] In addition, the merging unit (MU), which serves as the analog signal source handled by the main detection element and FD element, converts the current element and voltage element using separate A / D converters and supplies each data to the centralized IED, thereby preventing both the voltage element and the current element from becoming defective at the same time.

[0020] In addition, the output of the main detection element and the output of the accident detection element are separated from the aggregated IED as individual signal frames and transmitted to the MU, and the MU inspects both sets of data to prevent unnecessary operation from being caused by a single transmission operation due to a transient fault.

[0021] Next, an embodiment of the present invention will be described in detail with reference to the drawings as appropriate. EXAMPLES

[0022] FIG. 1 is a block diagram illustrating an example of a configuration of an aggregated IED and protection control system according to a first embodiment of the present invention.

[0023] As shown in FIG. 1, the protection and control system is composed of an IED (Intelligent Electronic Device) 2, merging units (hereinafter referred to as MU) 3a to 3c, a supervisory control and data acquisition (hereinafter referred to as SCADA) 8, a human-machine interface (hereinafter referred to as MU) 7, a gateway (hereinafter referred to as GW) 9, and a control station system (hereinafter referred to as CNT) 10. The IED 2 performs protection and control calculations. The MUs 3a to 3c take in analog signals, convert them to digital data, and transmit the signals as sample data, while receiving circuit breaker trip signals or substation equipment opening and closing signals from the IED 2 and issuing command signals to the main unit 4. The GW 9 performs protocol conversion of the transmission signals. The CNT 11 is connected via the network 10.

[0024] The IED 2 and the MUs 3a to 3c are connected via a process bus 5. The SCADA 8 and the GW 9 are connected via a station bus 6.

[0025] 1, the arithmetic and communication function 12 is integrated into a single semiconductor chip. The arithmetic and communication function 12 incorporates an arithmetic function 12a incorporating a plurality of CPU cores 121a to 121d, a memory system management mechanism 12b, a network control mechanism 12c, an I / O interface 12d, a memory controller 12e, and network interfaces 12f and 12g.

[0026] The IED 2 also includes a program memory 17 including a function for setting memory settings and protection functions, a setting memory 13 for storing setting values ​​for protection calculations, a main memory 14 including a memory for error correction (hereinafter referred to as an ECC memory), and communication interfaces (hereinafter referred to as communication IF) 15 to 16. The program memory 17 and setting memory 13 are composed of non-volatile memories, such as flash memories, that can retain information even when the power supply is lost.

[0027] The overall operation of the protection and control system 1 is as follows. Analog sample values ​​obtained by digitally converting voltage and current signals from the main unit 4 connected to the power system within MU3a-3c are passed to the IED2 via the process bus 5. The IED2 performs protection and control calculations based on the received sample values, and when it determines that a system fault has occurred, it passes a trip command signal to at least one of MU3a-3c. The MU that receives the trip command signal issues a trip signal to the main unit 4, which is the circuit breaker, to shut off the fault section. The IED2 receives an operation response signal from the main unit 4 and recognizes that the fault has been cleared. The IED2 reports information about this series of actions to the SCADA 8 and GW 9 via the station bus 6, and reports the system fault and system operation to an operator on the higher level.

[0028] FIG. 2 is a functional block diagram showing an example of the internal configuration of the MUs 3a to 3c according to the first embodiment of the present invention.

[0029] MU20 shown in Fig. 2 corresponds to each of MU3a-3c shown in Fig. 1. MU20 includes input converters 201a-201b that receive multiple voltage element signals, analog filters 202a-202b that prevent aliasing errors due to sampling, multi-channel A / D converter 203a with built-in A / D converters 204a-204b, and buffer memories 205a-205b. MU20 further includes input converters 201c-201d that receive multiple current element signals, analog filters 202c-202d that prevent aliasing errors, multi-channel A / D converter 203b with built-in A / D converters 204c-204d, and buffer memories 205c-205d.

[0030] A central processing unit (CPU) 206 receives, via a CPU bus 210, the data converted by the A / D converters 204a to 204b and 204c to 204d.

[0031] Also connected to the CPU bus 210 are a memory 207 equipped with a correction ECC memory required for calculations, and a network interface (hereinafter referred to as NW IF) for transmitting voltage and current signals as sample values ​​to the IED. The sample values ​​of the voltage and current signals are transmitted from a PHY device that converts them into optical signals to the IED 2 shown in Fig. 1 at a constant cycle (e.g., electrical angle of 3.75°).

[0032] Here, the analog input circuits, such as the analog filters and A / D converters, are configured separately for the voltage elements and current elements, so that a single defect in the A / D converter, which has the highest failure rate among the analog input circuits, does not cause all the data to become invalid values.

[0033] FIG. 3 is an explanatory diagram showing an example of an operation up to storage of the sample values ​​captured by the IED 2 according to the first embodiment of the present invention.

[0034] Specifically, FIG. 3 shows an example of the operation from when sample values ​​are taken into the IED 2 from the MUs 3a to 3c in FIG. 1 via the process bus 5 until information on a breaker command signal is stored, for example.

[0035] Although omitted in Fig. 1, the functions of the main detection element protection control processing unit 30, the accident detection element protection control processing unit 31, the data input / output processing unit 32, the interrupt control circuit 34, and the receiving circuit 35 shown in Fig. 3 are realized by the calculation and communication function 12 of the IED 2. Also, the main memory 33 corresponds to the main memory 14 in Fig. 1.

[0036] In FIG. 3, when the receiving circuit 35 receives the sample value L300, it passes an interrupt signal L301 indicating the reception to the interrupt control circuit 34, and stores the received sample value L300 in the data storage area 33c in the main memory 33 as the sample value L302.

[0037] The interrupt control circuit 34 outputs an interrupt signal L303 to the data input / output processing unit 32 in which a data input / output processing program is implemented. The data input / output processing unit 32 reads out the sample value L302 stored in the data storage area 33c as sample value data L304, performs data verification and buffering, and writes the sample data L305 for an accident detection element (hereinafter referred to as an FD element) in the data storage area 33b.

[0038] Although this operation is not shown in FIG. 3, it is an operation of writing data into the data storage area 33b via the network control mechanism 12c in FIG.

[0039] Furthermore, in a similar procedure, the sample value data L304 is written into the data storage area 33a as sample data L306 for the main detection element (hereinafter, M element).

[0040] At the same time, an interrupt signal for starting processing is applied to the protection control processing unit 30 of the M element and the protection control processing unit 31 of the FD element, thereby performing an action of reading data.

[0041] The protection control processing unit 30 of the M element and the protection control processing unit 31 of the FD element take in the respective sample data L309 and L306, execute their respective protection control processes, and then write the results, for example, information on a trip signal for tripping a circuit breaker (data L310 for the M element, data L308 for the FD element), into their respective data storage areas 33a and 33b.

[0042] Here, for example, the protection control processing unit 30 of the M element may execute the protection control processing based on both the data of the voltage element and the data of the current element among the data written in the data storage area 33a. On the other hand, the protection control processing unit 31 of the FD element may execute the protection control processing based on the data of the current element among the data written in the data storage area 33b. A detailed example of this will be described later with reference to FIG. 10.

[0043] FIG. 4 is an explanatory diagram showing an example of a data format of the sample value data issued by the MUs 3a to 3c according to the first embodiment of the present invention.

[0044] Fig. 4 shows the overall configuration of format 40. This is transmitted at Layer 2 of Ethernet, which eliminates overhead processing in network processing in order to satisfy real-time requirements, and uses a format specified in, for example, the international standard IEC 61850-9-2LE or IEC 61869-9.

[0045] The main components of the format 40 include a destination address 40a, a source address 40b, a communication header 40c, a data ID 40d, a sampling count 40e, information indicating the sampling status 40f, a sampling rate 40g, a sample value of a voltage element 40h, a sample value of a current element 40i, and a frame check sequence (FCS) 40j.

[0046] When the data input / output processing unit 32 shown in Fig. 3 reads out a frame in the format shown in Fig. 4 as sample value data L304, it checks the validity of the data using at least the data ID 40d, the sampling count 40e, and the information 40f indicating the sampling state. Similarly, the protection control processing unit 30 of the M element and the protection control processing unit 31 of the FD element shown in Fig. 3 also perform monitoring based on the information in the above-mentioned frame. Although not shown, quality information indicating the reliability of the data mapped to the international standard IEC 61850-9-2LE or IEC 61869-9 can be checked, and if the quality required for performing the protection control calculation is not satisfied, the data can be discarded.

[0047] In this way, the defective data can be discarded at the stage of receiving the SV (Sample Values) data, so that the protection and control device can prevent unnecessary operation. Of course, data errors that occur during the transmission process can also be verified by CRC check, and unnecessary data can be deleted to prevent unnecessary responses.

[0048] FIG. 5 is a block diagram illustrating an example of a software configuration of the IED 2 according to the first embodiment of the present invention.

[0049] 5 shows a software configuration 50 in the computing portion and a computing function 51. As an example of the software configuration, an OS and various drivers 505 are implemented on a virtualization platform 506, and an HMI and communication processing unit 501 is implemented on top of that, so that various communications, setting changes, and processing for reading information from inside the device are executed under the control of the OS and various drivers 505.

[0050] The virtualization platform 506 is software that runs programs with different operating environment specifications in real time on the same hardware resources, and is an environment that runs application programs that run on an OS implemented on the virtualization platform and OS-less application programs.

[0051] The protection control processing unit 502 of the M element executes applications for various protection relay calculation processing, protection sequence processing, and control processing of the M element, which are real-time processing. In the first embodiment, the protection control processing unit 502 of the M element is implemented on a virtualization platform 506.

[0052] Similarly, the protection control processing unit 503 of the FD element executes the protection control processing of the FD element, which is real-time processing. In the first embodiment, the protection control processing unit 503 of the FD element is implemented on the virtualization platform 506, similar to the protection control processing unit 502 of the M element.

[0053] Both the protection control processing unit 502 of the M element and the protection control processing unit 503 of the FD element are core parts of the protection control calculation, and require real-time processing to complete the calculation processing within a specified time. For this reason, in the first embodiment, they are configured to be implemented on a virtualization platform 506 that is capable of high-speed response to realize real-time processing without the intervention of an OS.

[0054] The data input / output processor 504 takes in data from the MUs shown in Fig. 1, validates and buffers the data, and then stores the data in the main memory 14 in Fig. 1, and transmits the data from the main memory 14 in which the output results are stored to the MUs 3a to 3c. The data input / output processor 504 also has a real-time processing requirement that it must complete processing within a specified time, so it is configured without the intervention of the OS.

[0055] Note that the protection control processing unit 502 of the M element, the protection control processing unit 503 of the FD element, and the data input / output processing unit 504 shown in Figure 5 correspond to the protection control processing unit 30 of the M element, the protection control processing unit 31 of the FD element, and the data input / output processing unit 32 shown in Figure 3, respectively.

[0056] The calculation function 51 shown in Fig. 5 corresponds to the calculation function 12a shown in Fig. 1. That is, CPU cores 510a to 510d constituting the calculation function 51 shown in Fig. 5 correspond to, for example, the CPU cores 121a to 121d shown in Fig. 1. In the example of Fig. 5, the processes of an HMI / communication processing unit 501, a protection control processing unit 502 of an M element, a protection control processing unit 503 of an FD element, and a data input / output processing unit 504 are assigned to CPU cores 510a, 510b, 510c, and 510d, respectively.

[0057] What is important in the processing configuration of Fig. 5 is a mechanism for protecting memory contents by logically separating and dividing the processes assigned to each CPU core with respect to the main memory 14, which is the shared part shown in Fig. 1. In other words, it is important to have a mechanism for preventing memory contents necessary for a processing unit itself from being destroyed by other processing units. Protection of memory contents will be explained using Fig. 6.

[0058] FIG. 6 is an explanatory diagram showing an example of an operation when each processing unit accesses a physical address in the first embodiment of the present invention.

[0059] 6 shows an HMI / communication processing unit 60, an M element protection control processing unit 61, an FD element protection control processing unit 62, and a data input / output processing unit 63. Note that the HMI / communication processing unit 60 to the data input / output processing unit 63 in Fig. 6 correspond to the processing contents executed by the HMI / communication processing unit 501 to the data input / output processing unit 504 in Fig. 5.

[0060] Each process of the HMI / communication processing unit 60 to the data input / output processing unit 63 is executed by the CPU cores 510a to 510d assigned to each process by accessing information 67a to 67d in a memory 67. The memory 67 corresponds to the main memory 33 shown in FIG. 3. The information 67a to 67d in the memory 67 stores programs and data for executing each process. As mentioned above, a mechanism is required to protect the memories of the CPU cores 501a to 510d from mutual damage when they execute their processes.

[0061] When each of the processing units from the HMI / communication processing unit 60 to the data input / output processing unit 63 accesses information 67a to 67d in the memory 67, the signals are first converted by the bus conversion circuits 64a to 64d. The bus conversion circuits 64a to 64d are components that convert signals into an internal bus format in order to interface with functions between internal modules. For example, the bus conversion circuits 64a to 64d convert signals into a high-speed interface such as the well-known AXI (Advanced eXtensible Interface) bus, and convert the signals from the HMI / communication processing unit 60 to the data input / output processing unit 63 into signals L60a to L60d, respectively.

[0062] The signals L60a to L60d include an ID number, address information, access form for reading / writing, data, and the like when accessing.

[0063] In addition, the above-mentioned ID number, address information, and read / write access mode information are stored together with the protection control program in the program memory 17 in FIG.

[0064] That is, settings related to access protection are made at the initial time before the protection control function starts operating.

[0065] The protection circuits 65a to 65d are circuits that invalidate any unauthorized access based on the above information. The protection circuits 65a to 65d determine whether the above ID numbers, address information, and access types match in order to detect abnormalities and determine whether an access is authorized or unauthorized. If the program runs out of control due to unauthorized program processing or temporary device damage, the access is invalidated to protect the memory contents allocated to other CPU cores.

[0066] The memory controller 66 converts internal logical addresses into actual physical addresses of the memory, and determines the priority order when multiple access requests overlap, and arbitrates memory access to avoid contention. The memory controller 66 shown in Fig. 6 corresponds to the memory controller 12e shown in Fig. 1.

[0067] Next, the operation of memory protection during memory access will be described according to the processing flow shown in FIG.

[0068] FIG. 7 is a flowchart illustrating an example of a memory protection operation executed by the IED 2 according to the first embodiment of the present invention.

[0069] In Fig. 7, memory access is started, and the protection circuits 65a to 65d perform the following protection operation for the signals L60a to L60d output from the bus conversion circuits 64a to 64d shown in Fig. 6. Note that the memory range and attributes of the range (e.g., ID number, permitted access type, etc.) are preset in the protection circuits 65a to 65d at the time of initialization.

[0070] In processing step S001, the protection circuit judges whether the accessed address is within the range assigned to the memory. If it is outside the range, the process proceeds to S008, where it is judged to be an abnormality, and in S009, it proceeds to exception processing, notifying the contents of the abnormality, and takes measures according to the abnormality, and then ends the process.

[0071] In process step S002, the protection circuit determines whether the ID used at the time of access matches the ID permitted for the memory. If they do not match, the process proceeds to S008 and measures are taken according to the abnormality.

[0072] In process step S003, the protection circuit determines the type of access, and in the case of writing, transitions to S004, and in the case of reading, transitions to S006.

[0073] In process step S004, the protection circuit checks whether writing is permitted for the area, and if there is a mismatch, the process proceeds to S008 and takes action according to the abnormality. If writing is permitted, the process proceeds to S005 and a write operation is performed on the memory.

[0074] In process step S006, the protection circuit checks whether reading is permitted for the area, and if there is a mismatch, the process proceeds to S008 to take action according to the abnormality. If permitted, the process proceeds to S007 to perform a read operation on the memory.

[0075] By checking memory access multiple times in this way, mutual destruction of memory contents due to unauthorized access can be prevented. Since the protection control processing unit 61 of the M element and the protection control processing unit 62 of the FD element in Fig. 6 can be completely logically separated with respect to the memory 67, which is the shared part, safety regarding memory access can be guaranteed.

[0076] 6, a redundant memory (ECC memory in this case) is added to the memory itself, and a function such as the well-known SECDED method is implemented, which detects and corrects one-bit data errors and detects errors of two or more bits as an anomaly, for example. This makes it possible to ensure greater safety by detecting and dealing with physical anomalies as well.

[0077] It goes without saying that physical anomaly detection is not limited to the SECDED method, but can also be achieved by implementing well-known error correction functions such as block coding methods.

[0078] Next, the operation after the protection control calculation is performed will be described. The protection control device of this embodiment issues a breaker command or a control command to a substation device such as a circuit breaker after the protection control calculation is performed. The operation will be described with reference to FIG.

[0079] FIG. 8 is an explanatory diagram illustrating an example of an operation that the IED 2 according to the first embodiment of the present invention executes after a protection calculation.

[0080] Fig. 8 shows a protection control processing unit 80 of the M element, a protection control processing unit 81 of the FD element, a memory 82, a transmission circuit 83, and an OS driver 84. The protection control processing unit 80 of the M element, the protection control processing unit 81 of the FD element, and the memory 82 correspond to the protection control processing unit 61 of the M element, the protection control processing unit 62 of the FD element, and the memory 67 shown in Fig. 6. Also, the OS driver 84 shown in Fig. 8 corresponds to the OS driver 505 shown in Fig. 5.

[0081] The protection control processing unit 80 of the M element and the protection control processing unit 81 of the FD element write the data L802 and data L800, which are the results of their processing, into storage areas 82a and 82b, respectively, of the memory 82. Note that the data L802 and data L800 shown in Fig. 8 correspond to the data L310 and data L308 shown in Fig. 3, respectively.

[0082] 8, after the M element protection control processing unit 80 and the FD element protection control processing unit 81 finish processing, the OS driver 84 is instructed to start data transfer. The M element and the FD element perform arithmetic processing at a constant cycle, but are operated asynchronously in terms of timing.

[0083] When OS driver 84 is started, it follows the memory access procedure explained in FIG. 7 and reads data L803 and data L801 from memory areas 82a and 82b, respectively.

[0084] Thereafter, the output data L805 and L804 of the M element and the FD element, respectively, are set in the data transmission circuit 83. These operations are combined with necessary information by, for example, the IEC 61850 protocol stack, and are ultimately set by the driver 84 that performs communication.

[0085] The transmission circuit 83 transmits a data frame L806 from the memory system manager 12b in FIG. 1 through the network control mechanism 12c, network IF 12f, communication IF 15, and process bus 5 to MU 3a to MU 3c.

[0086] FIG. 9 is an explanatory diagram showing an example of the frame configuration of the data frame L806 in the first embodiment of the present invention.

[0087] FIG. 9 shows a GOOSE frame 90 of IEC 61850 as an example of a frame configuration.

[0088] The GOOSE frame 90 is composed of a destination address 90a, a source address 90b, a communication header 90c, a data ID 90d, a data length 90e, control block information 90f, a status No. 90g, a sequence No. 90h, control data 90i such as a circuit breaker trip command, and a frame check sequence (FCS) 90j.

[0089] For example, by verifying that the frame sequence number 90h is counted up as specified, the receiving side can confirm the accuracy of the data, so if an abnormal value is received, the data can be discarded to prevent unnecessary operation.

[0090] FIG. 10 is an explanatory diagram illustrating an example of an operation based on the M elements and FD elements such as the IED 2 and the MU 3a according to the first embodiment of the present invention.

[0091] Specifically, Figure 10 is provided to functionally explain the operation of the M element and the FD element in the protection relay and the M element and the FD element in the MU as an example in the overall configuration shown in Figure 1, and will be described below.

[0092] In FIG. 10, a function block 100 performs processing within the IED 2 in FIG. 1, a function block 101 is an M element, and a function block 102 is an FD element.

[0093] For the M element, processing of M_RY1 to M_RY5 shown in relay unit elements 101a to 101e is performed. The processing result of M_RY1 is input to OR processing 10j. The processing results of M_RY2 and M_RY3 are subjected to timer processing TIM1_101f and timer processing TIM2_101g, respectively, and then input to OR processing 10j. The processing results of M_RY2 and M_RY3 are input to OR processing 10j via timer processing TIM3_101i after AND processing 101h. The output of OR processing 10j is stored in transmission buffer memory 101k, and transmission processing 101l is started to send out as frame L100a including data of M element detection onto the process bus.

[0094] For the FD element, the relay single element 102a performs the FD_RY process, stores the result in the transmission buffer memory of 102b, and starts the transmission process 102c to send a frame L100b including data on the detection of the FD element onto the process bus.

[0095] In this embodiment, due to the difference between the voltage information and current information of the power system handled by M detection and FD detection, unnecessary operation is not performed even if an error occurs in one of the pieces of information. An example is described below.

[0096] For example, M_RY1 to M_RY3 can be configured with distance relay devices (44SX1 to 44SX3) that handle voltage and current information, and M_RY4 can be configured with an overcurrent relay element, and M_RY5 can be configured with an undervoltage relay element, thereby forming the main detection protection elements.

[0097] In the functional block 102 of the FD element, for example, by implementing the FD_RY of the overcurrent element, relay calculations can be performed regardless of voltage information, so that even if the A / D conversion unit of the voltage element momentarily outputs an abnormal value, it can be reliably blocked by the relay of the current element.

[0098] Fig. 10 shows an example where a composite element is implemented in the M detection element, and a single-element, simple, high-speed relay is implemented in the FD element, but the configuration is not limited to the above as long as the handling of the voltage and current elements can be separated individually. For example, the M element may be implemented to detect a single element (for example, only voltage or only current), and the FD element may be implemented to detect a composite element. Alternatively, the M element may be implemented to detect either voltage or current, and the FD element may be implemented to detect the other one.

[0099] In addition, the data sent onto the process bus is completely separated and sent separately for M detection and FD detection, preventing both the M detection element and the FD detection element from simultaneously operating unnecessarily due to a temporary defect in the transmission circuit or transmission buffer.If a data error occurs on the process bus, the CRC calculation result of the transmission data will no longer match the FCS attached to the end of the frame, making it possible to verify the data.

[0100] Therefore, it is important to ensure that the M element information is separated from the FD element information before transmitting the data.

[0101] 10 further shows processing function 103 of the MU of the M detection element and processing function 104 of the MU of the FD detection element. The final outputs of processing function 103 of the MU of the M detection element and processing function 104 of the MU of the FD detection element drive relays 105 and 106, respectively, for driving trip relays of the circuit breaker, and the relay contacts of both relays 105 and 106 are closed, ultimately tripping the circuit breaker.

[0102] MU processing function 103 of the M detection element is composed of reception processing 103a that receives signals from the process bus, output processing 103b, relay driver 103c, and auxiliary relay 103d. Similarly, MU processing function 104 of the FD detection element is composed of reception processing 104a that receives signals from the process bus, output processing 104b, relay driver 104c, and auxiliary relay 104d. In this embodiment, MU processing function 103 of the M detection element and MU processing function 104 of the FD detection element are completely separate, so that a single component defect or data defect (so-called one mistake) will not ultimately cause the device to malfunction. EXAMPLES

[0103] Next, a second embodiment of the present invention will be described with reference to Fig. 11. The configuration of the system according to the second embodiment is similar to that of the system according to the first embodiment shown in Figs. 1 to 10, except for the differences described below, and therefore the description will be omitted.

[0104] FIG. 11 is an explanatory diagram illustrating an example of an operation based on M elements and FD elements such as the IED 2 and the MU 3a according to the second embodiment of the present invention.

[0105] Specifically, FIG. 11 shows a modification of the functional block configuration shown in FIG.

[0106] The difference with Fig. 10 is that in the configuration of Fig. 10, the output to MU is sent via separate routes, whereas in the configuration of Fig. 11, the output is sent via the same route. However, the output of the M element and the output of the FD element are separated as separate frames, and are configured to prevent both from moving in the operating direction at the same time due to a single device failure. This idea is the same as in the first embodiment.

[0107] 11, a functional block 110 of the second embodiment is composed of a functional block 111 for processing the M detection element and a functional block 112 for processing the FD detection element. The functional blocks 101a to 101j constituting the functional block 111 for the M detection element and the functional block 102a constituting the functional block 112 for the FD detection element are the same as those of the first embodiment.

[0108] A shared memory 110k is placed between the function block 111 and the function block 112 in Fig. 11, and each relay stores the output result in the shared memory 110k. However, the storage areas in the shared memory 110k are different for M detection and FD detection, and each area is made accessible to authorized processing functions.

[0109] The transmission process 111a reads the output for M detection from the shared memory 110k, assembles the information into individual frames, and sends frame L100a to the process bus. Similarly, the transmission process 111a reads the output for FD detection from the shared memory 110k, assembles the information into individual frames, and sends frame L100b to the process bus. Naturally, since these are individual frames, there is a slight time difference in the sending.

[0110] The MU processing function 113 of the second embodiment differs from the MU processing functions 103, 104 of the first embodiment in that the functions that were configured separately are made common and information is received and processed separately. Specifically, while the MU processing function 103 of the M detection element of the first embodiment shown in Fig. 10 has reception processing 103a and output processing 103b, and the MU processing function 104 of the FD detection element has reception processing 104a and output processing 104b, in the second embodiment, an MU processing function 113 is provided that processes both the M detection element and the FD detection element, and the reception processing 113a and output processing 113b process both frames L100a and L100b.

[0111] However, since there is a risk that the relay drivers 103c, 104c and the auxiliary relays 103d, 104d will cause an erroneous output due to a single component failure, resulting in unwanted operation (malfunction), this portion is provided with multiple circuits for redundancy, as in the first embodiment.

[0112] Therefore, the reception process 113a and the output process 113b handle data accesses separately for M detection elements and FD detection. As explained above, with regard to transient defects that occur during data access, the data is protected by the ECC function, and necessary information such as the registers of the processing unit is temporarily stored in memory, and the correctness of the data can be confirmed by checking (matching) the stored information and monitoring the state of the registers.

[0113] That is, by configuring and operating as shown in the second embodiment, even if a single component defect or data defect (so-called one error) occurs, it is possible to ultimately prevent malfunction of the device. EXAMPLES

[0114] Next, a third embodiment of the present invention will be described with reference to Figures 12 to 14. The configuration of the system according to the third embodiment is similar to that of the system according to the first embodiment shown in Figures 1 to 10 or the system according to the second embodiment shown in Figure 11, except for the differences described below, and therefore the description will be omitted.

[0115] FIG. 12 is a block diagram illustrating an example of a software configuration of an IED 2 according to a third embodiment of the present invention.

[0116] The software configuration shown in FIG. 12 is a modified example of the software configuration of the first embodiment shown in FIG.

[0117] 12 shows the software configuration 120 in the computing part. An HMI / communication processing unit 1201 performs processing for various communications, changing settings, and reading information inside the device. The HMI / communication processing unit 1201 is configured to run under the control of an OS / driver 1205a implemented on a virtualization platform 1206.

[0118] The protection control processing unit 1202 of the M element executes applications for various protection relay calculation processing, protection sequence processing, and control processing of the M element, which are real-time processing. The protection control processing unit 1202 of the M element is configured to operate under the management of an OS driver 1205b implemented on a virtualization platform 1206.

[0119] The protection control processing unit 1203 of the FD element executes the protection control processing of the FD element, which is a real-time processing. The protection control processing unit 1203 of the FD element is configured to operate under the management of an OS driver 1205c implemented on the virtualization platform 506.

[0120] The data input / output processing unit 1204 takes in data from the MUs shown in FIG. 1, MUs 3a to 3c, performs data verification and buffering, and then stores the data in the main memory 14 in FIG. 1, and transmits the data from the main memory 14 in which the output results are stored to the MUs MUs 3a to 3c.

[0121] Although omitted in FIG. 12, in the same manner as in the first embodiment, in the third embodiment, the HMI communication processing unit 1201, the protection and control processing unit 1202 of the M element, the protection and control processing unit 1203 of the FD element, and the data input / output processing unit 1204 are each assigned to a different CPU core.

[0122] What is important in the processing configuration of Fig. 12 is a mechanism for protecting memory contents by logically separating and dividing the processes assigned to each CPU core with respect to the main memory 14, which is the shared part shown in Fig. 1. In other words, it is important to have a mechanism for preventing memory contents necessary for a processing unit itself from being destroyed by other processing units. Protection of memory contents will be explained using Figs. 13 and 14.

[0123] FIG. 13 is an explanatory diagram showing an example of the configuration of a memory management unit (hereinafter, MMU) for converting a virtual address of a memory into a physical address in the third embodiment of the present invention.

[0124] The MMU controls the hardware translation tables in memory.

[0125] FIG. 13 shows a page table base register selector 130a, a virtual page address 130b, and a physical address page offset 130c.

[0126] FIG. 13 further shows a page table entry section 131, information 131a indicating whether page information is valid or invalid, physical page information 131b, and memory attribute and access permission information 131c.

[0127] The page table register unit 132 shown in FIG.

[0128] 13 is composed of a physical address 133a and a physical address page offset 133b. The physical address 133a stores a physical page indicated by the physical page information 131b, and the physical address page offset 133b stores information indicated by the physical address page offset 130c as is.

[0129] Using this type of conversion means, the memory area indicated by the virtual address is mapped so that it does not overlap with the physical address. Moreover, based on the attribute information of the memory area and the predetermined access permission information, the memory contents can be protected even if unnecessary access occurs due to a component failure, etc. In other words, the configuration is such that unnecessary operation will not occur due to a single defect (one mistake).

[0130] In the unlikely event that an unnecessary access occurs, the CPU core that performed the access is notified as an exception, protecting the contents of the memory itself from being destroyed.

[0131] FIG. 14 is an explanatory diagram showing an example of an operation when each processing unit accesses a physical address in the third embodiment of the present invention.

[0132] FIG. 14 shows an HMI / communication processing unit 1201, an M element protection control processing unit 1202, an FD element protection control processing unit 1203, and a data input / output processing unit 1204.

[0133] The operations of the above processing sections are as described above.

[0134] 14 further shows an OS function 1400, an MMU function 1401 shown in Fig. 13, and a memory 1402. The memory 1402 stores a memory 1402a handled by the data input / output processing unit 1204, a memory 1402b handled by the protection control processing unit 1203 of the FD element, a memory 1402c handled by the protection control processing unit 1202 of the M element, and a memory 1402d handled by the HMI / communication processing unit 1201.

[0135] As described above, by adopting the configuration and operation shown in the third embodiment, even if a single component defect or data defect (a so-called one error) occurs, it is possible to ultimately prevent malfunction of the device.

[0136] In the above embodiments of the present invention, a protection and control device has been described that is configured by combining an aggregated IED that uses a device with a built-in multi-CPU core and an MU that has analog and digital I / O functions connected via a network. By incorporating the above-mentioned malfunction prevention function, it is possible to obtain a reliability equivalent to that of the malfunction prevention function realized by the conventional two hardware components of main detection (M detection element) and fault detection (FD detection element) without increasing the scale of the hardware.

[0137] Furthermore, the system according to the embodiment of the present invention may be configured as follows.

[0138] (1) A protection and control system (e.g., protection and control system 1) having a protection and control device (e.g., IED 2) and a merging unit (e.g., MU 3a, etc.), the protection and control device having a calculation unit (e.g., calculation function 12a) including a plurality of processor cores (e.g., CPU cores 121a to 121d) and a memory (e.g., main memory 14), an input / output processing unit (e.g., data input / output processing unit 32) executed by a first processor core of the plurality of processor cores writes data of a first detection element (e.g., M element) and data of a second detection element (e.g., FD element) of data received from the merging unit into a first area (e.g., data storage area 33a) and a second area (e.g., data storage area 33b) of the memory, respectively, and A first protection control processing unit (e.g., protection control processing unit 30 of an M element) executed by a second processor core among the multiple processor cores executes a protection control calculation based on the data of the first detection element written in the first area and outputs first protection control data (e.g., frame L100a) including the result of the calculation, a second protection control processing unit (e.g., protection control processing unit 31 of an FD element) executed by a third processor core among the multiple processor cores executes a protection control calculation based on the data of the second detection element written in the second area and outputs second protection control data (e.g., frame L100b) including the result of the calculation, and the merging unit outputs an operation command for equipment for protection control based on the first protection control data and the second protection control data.

[0139] This means that even if a single component failure or program error occurs, the main detection and accident detection protection control units will not fail simultaneously, making it possible to prevent unnecessary operation even in a single centralized IED.This ensures reliability without the need for a redundant hardware configuration and reduces costs.

[0140] (2) A protection and control system as described in (1) above, wherein the memory has an error detection function.

[0141] This makes it possible to detect and deal with physical abnormalities as well, thereby ensuring greater safety.

[0142] (3) In the protection control system described in (2) above, the protection control device further has a protection circuit (e.g., protection circuits 65a to 65d) for protecting data written to the memory, and when there is a request to access the memory, the protection circuit determines whether information added to the data to be accessed is consistent with preset information, and if there is a match, executes the access, and if there is no match, determines that there is an abnormality and outputs the abnormality details.

[0143] This makes it possible to prevent mutual destruction of memory contents due to unauthorized access.

[0144] (4) A protection control system as described in (3) above, wherein the information attached to the data that is the target of the access includes the type of data that is the target of the access and the address of the target of the access, and determines whether the address of the target of the access is within a preset range (e.g., S001), whether the type of data that is the target of the access matches a preset type (e.g., S002), whether writing to the address of the target of the access is permitted if the access is a write (e.g., S004), and whether reading from the address of the target of the access is permitted if the access is a read (e.g., S006), and if any of the above determination conditions are met, it is determined that the information attached to the data that is the target of the access is consistent with the preset information.

[0145] This makes it possible to prevent mutual destruction of memory contents due to unauthorized access.

[0146] (5) The protection and control system described in (1) above, wherein the merging unit has a first analog / digital converter (e.g., multi-channel A / D converter 203a) that converts a measurement value of a voltage element measured in the power system into digital data, and a second analog / digital converter (e.g., multi-channel A / D converter 203b) that converts a measurement value of a current element measured in the power system into digital data, wherein the digital data of the voltage element is included in at least one of the data of the first detection element and the data of the second detection element, and the digital data of the current element is included in at least one of the data of the first detection element and the data of the second detection element, and the device for protection and control is a circuit breaker for protecting the power system.

[0147] This makes it possible to prevent all data from becoming invalid due to a single defect in the A / D converter, which has the highest failure rate among analog input circuits.

[0148] (6) The protection and control system described in (5) above, wherein the merging unit has a first relay (e.g., a relay driver 103c and an auxiliary relay 103d) that operates the equipment for protection and control based on the first protection and control data, and a second relay (e.g., a relay driver 104c and an auxiliary relay 104d) that operates the equipment for protection and control based on the second protection and control data, and the equipment for protection and control operates when both the first relay and the second relay operate.

[0149] This makes it possible to prevent a single component defect or data error (a so-called one mistake) from ultimately causing the device to malfunction.

[0150] (7) A protection control system as described in (6) above, wherein the protection control device has a shared memory (e.g., shared memory 101k) that stores the first protection control data and the second protection control data, and includes the first protection control data and the second protection control data read from the shared memory in separate data frames (e.g., frames L100a and L100b), respectively, and transmits them to the merging unit (e.g., MU processing function 113) via the same route, and when the received data frame includes the first protection control data, the merging unit operates the first relay based on the first protection control data, and when the received data frame includes the second protection control data, the second relay operates based on the second protection control data.

[0151] This makes it possible to ultimately prevent equipment malfunction even if a single component defect or data error (a so-called one error) occurs.

[0152] (8) A protection control system as described in (1) above, wherein the first protection control processing unit executes on a first operating system (e.g., OS driver 1205b) implemented in the second processor core, and the first protection control processing unit executes on a second operating system (e.g., OS driver 1205c) implemented in the third processor core.

[0153] This makes it possible to ultimately prevent equipment malfunction even if a single component defect or data error (a so-called one error) occurs.

[0154] The present invention is not limited to the above-mentioned embodiment, and various modifications are included. For example, the above-mentioned embodiment has been described in detail for better understanding of the present invention, and is not necessarily limited to those having all the configurations described. Also, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Also, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0155] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as a program, table, file, etc. that realizes each function can be stored in a storage device such as a non-volatile semiconductor memory, a hard disk drive, or an SSD (Solid State Drive), or in a computer-readable non-transitory data storage medium such as an IC card, an SD card, or a DVD.

[0156] In addition, the control lines and information lines are shown as those considered necessary for the explanation, and not all control lines and information lines in the product are shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0157] 1 Protection and control system, 2 Centralized IED, 3 MU, 4 Main substation unit, 5 Process bus 6 Station bus, 7 HMI, 8 Supervisory control system (SCADA), 9 Gateway 10 Communication networks, 11 Control systems, 12 Composite semiconductor devices with built-in multi-core CPUs 13 setting memory, 14 main memory, 15, 16 communication interface 20 MU circuit, 201 input converter, 202 analog filter, 203, 204 A / D converter 205 buffer memory, 206 MU CPU, 207 MU main memory, 208 MU network interface, 209 communication PHY 30, 502, 61, 80, 1202 Main detection protection control calculation processing unit 31, 503, 62, 81, 1203 Accident detection protection control calculation processing section 32, 504, 63, 81, 1204 Data input / output processing section Memory for 33, 67, 82 IEDs 34 Interrupt control circuit 4, 40 Frame format of analog input value 50, 120 Software configuration of IED, 501, 60, 1201 HMI / communication processing unit 64 Bus conversion circuit 505, 1205, 1400 OS drivers, 506, 1206 Virtualization infrastructure 510 CPU cores 65 Memory protection circuit, 66 Memory controller 83 Transmitting circuit 90 Digital output frame format 100, 110 IED configuration 101, 111 Main detection protection function block 102, 112 Accident detection protection function block 103, 104, 113 MU Function Blocks 105, 106 Trip contact 130 Virtual Address 131 MMU page entry table 132 MMU Page Table Base Register 133 Physical Address 1401 MMU

Claims

1. A protection and control system having a protection and control device and a merging unit, The protection and control device has a calculation unit including a plurality of processor cores and a memory, an input / output processing unit executed by a first processor core among the plurality of processor cores writes data of a first detection element and data of a second detection element among the data received from the merging unit into a first area and a second area of ​​the memory, respectively; A first protection control processing unit executed by a second processor core among the plurality of processor cores executes a protection control calculation based on the data of the first detection element written in the first area, and outputs first protection control data including the result of the calculation; A second protection control processing unit executed by a third processor core among the plurality of processor cores executes a protection control calculation based on the data of the second detection element written in the second area, and outputs second protection control data including the result of the calculation; The protection and control system, characterized in that the merging unit outputs an operation command for equipment for protection and control based on the first protection and control data and the second protection and control data.

2. The protection and control system according to claim 1, A protection and control system characterized in that the memory has an error detection function.

3. The protection and control system according to claim 2, The protection and control device further includes a protection circuit for protecting data written to the memory, The protection circuit, when a request for access to the memory is received, determines whether the information attached to the data to be accessed matches pre-set information, and if there is a match, executes the access, and if there is no match, determines that an abnormality has occurred and outputs details of the abnormality.

4. The protection and control system according to claim 3, the information added to the data to be accessed includes a type of the data to be accessed and an address of the data to be accessed; determining whether the address of the target of the access is within a preset range, whether the type of data of the target of the access matches a preset type, whether writing to the address of the target of the access is permitted if the access is a write access, and whether reading from the address of the target of the access is permitted if the access is a read access; A protection and control system characterized in that, when all of the above judgment conditions are met, it is determined that the information added to the data to be accessed is consistent with predetermined information.

5. The protection and control system according to claim 1, The merging unit includes a first analog-to-digital converter that converts a measurement value of a voltage element measured in the power system into digital data, and a second analog-to-digital converter that converts a measurement value of a current element measured in the power system into digital data; the digital data of the voltage element is included in at least one of the data of the first detection element and the data of the second detection element; the digital data of the current element is included in at least one of the data of the first sensing element and the data of the second sensing element; A protection and control system, characterized in that the protection and control device is a circuit breaker for protecting the power system.

6. The protection and control system according to claim 5, The merging unit includes: A first relay that operates a device for the protection control based on the first protection control data, and a second relay that operates the device for the protection control based on the second protection control data, A protection and control system characterized in that the device for protection and control operates when both the first relay and the second relay operate.

7. The protection and control system according to claim 6, The protection and control device includes: A shared memory that stores the first protection control data and the second protection control data, The first protection control data and the second protection control data read from the shared memory are included in separate data frames, and transmitted to the merging unit via the same path; The merging unit is characterized in that, when a received data frame includes the first protection control data, the first relay operates based on the first protection control data, and, when a received data frame includes the second protection control data, the second relay operates based on the second protection control data.

8. The protection and control system according to claim 1, the first protection control processing unit is executed on a first operating system implemented in the second processor core; A protection and control system, characterized in that the first protection and control processing unit is executed on a second operating system implemented in the third processor core.

9. A protection and control method executed by a protection and control system, The protection and control system includes a protection and control device and a merging unit, The protection and control device has a calculation unit including a plurality of processor cores and a memory, The protection and control method includes: a step in which an input / output processing unit executed by a first processor core among the plurality of processor cores writes data of a first detection element and data of a second detection element among data received from the merging unit into a first area and a second area of ​​the memory, respectively; A first protection control processing unit executed by a second processor core among the plurality of processor cores executes a protection control calculation based on the data of the first detection element written in the first area, and outputs first protection control data including the result of the calculation; A second protection control processing unit executed by a third processor core among the plurality of processor cores executes a protection control calculation based on the data of the second detection element written in the second area, and outputs second protection control data including the result of the calculation; A protection and control method comprising: a step of outputting an operation command for a device for protection and control by the merging unit based on the first protection and control data and the second protection and control data.

Images