Preliminary protection control device, abnormality detection and recovery method, and protection control system
Patent Information
- Application Number
- JP2023148799
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2023-09-13
- Publication Date
- 2025-03-26
- Estimated Expiration
- 2043-09-13
Smart Images

Figure 2025041471000001_ABST
Abstract
Description
[Technical field]
[0001] The present invention relates to a protection and control technology for power systems, and in particular to an abnormality detection method, a system recovery method, and a switchback method upon abnormality recovery when a calculation device (Intelligent Electronic Device (hereinafter, IED)) called a digital protection and control device that connects a higher-level device (Station Computer (hereinafter, SC), Gateway (hereinafter, GW)) and a lower-level device (Murging Unit (hereinafter, MU)) is used as a single system. [Background technology]
[0002] With the advancement of digital devices and communication technology, MUs are installed closer to the equipment to be monitored, and information is exchanged with IEDs installed in the substation switchboard room via process bus transmission. In addition, for the purpose of monitoring and controlling maintenance personnel, the SC and GW communicate with the IEDs via station bus transmission.
[0003] One of the benefits of digitalization is cost reduction through streamlining of equipment, which is one of the objectives of digitalization, but in order to ensure system reliability, the system series of extra-high voltage substations are basically operated in two series. IEDs are divided into protective relay devices for monitoring and removing system faults, and control devices for monitoring the substation status and operating the equipment, but if these are used as a single system, degenerate operation or system shutdown will be required in the event of an IED abnormality.
[0004] Japanese Patent Publication No. 2010-068594 (Patent Document 1) discloses a protection and control system in which IEDs are used as a single system and a spare IED and a database IED are installed, so that when an abnormality occurs in the protection and control device, information about the failed device is downloaded to the database IED and the database IED is restored as an alternative device to the abnormal IED. [Prior art documents] [Patent documents]
[0005] [Patent Document 1] JP 2010-068594 A Summary of the Invention [Problem to be solved by the invention]
[0006] As mentioned above, Patent Document 1 discloses a protection and control system in which IEDs are treated as a single system and a backup IED and a database IED are installed, but does not clearly state the abnormality detection method and the response after recovery. In a digital substation, many MUs and IEDs are connected, which makes it complicated to determine the abnormality detection method. In addition, as for the recovery method when an abnormality is detected, it is necessary to clarify a mechanism for determining and restoring the target IED using only the backup IED, and the response of the backup IED when the target IED is restored. [Means for solving the problem]
[0007] In order to solve at least one of the above problems, the present invention provides a backup protection control device connected to a plurality of merging units and a plurality of protection control devices, each of the merging units being connected to at least one of an instrument that measures a power system and an apparatus that controls the power system, each of the protection control devices having a function of communicating with at least one of the merging units and performing calculations for protecting or controlling the power system, the backup protection control device having a processor and a memory, the memory holding a plurality of protection control programs for realizing each of the plurality of protection control devices, when the processor detects an abnormality in any of the plurality of protection control devices, determines whether the protection control program for realizing the functions of the protection control devices other than the protection control device that detected the abnormality is being executed, and when the protection control program for realizing the functions of the protection control devices other than the protection control device that detected the abnormality is not being executed, starts execution of the protection control program for realizing the functions of the protection control device that detected the abnormality. Effect of the Invention
[0008] According to one aspect of the present invention, it is possible to ensure system reliability and reduce costs by using a single system for protection IEDs and control IEDs without using two systems. This makes it possible to realize a configuration suitable for IEDs that does not require metal cables.
[0009] Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]
[0010] [Figure 1] 1 is a block diagram showing an example of a configuration of a digital substation system according to an embodiment of the present invention. [Diagram 2] A block diagram showing the internal configuration of a backup IED in an embodiment of the present invention. [Diagram 3] 10 is a flowchart illustrating an example of the operation of a backup IED according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0011] Hereinafter, the embodiments will be described with reference to the drawings.
[0012] FIG. 1 is a block diagram showing an example of a configuration of a digital substation system 1 according to an embodiment of the present invention.
[0013] Metal wires connect MU8-1 to MU8-L with devices (CB, LS) 10 such as circuit breakers (hereinafter CB) and disconnecting switches (hereinafter LS) installed in the substation, and instruments (PT, CT) 9 such as voltage transformers (hereinafter PT) and potential transformers (hereinafter CT). MU8-1 to MU8-L digitize the status of the devices and instruments for each section in the substation and send them out for transmission on the process bus 12. In the following explanation, MU8 may be used to refer to all or each of MU8-1 to MU8-L. The same applies to protection IEDs 5-1 to 5-N and control IEDs 6-1 to 6-M described below.
[0014] The protective IEDs 5-1 to 5-N detect faults in the substation using protective relay calculations based on the analog data obtained from the instruments 9, and if an accident is determined to have occurred, they send a command to the MU side to shut off the target equipment via the process bus 12. Following that command, the MU 8 shuts off the target CB via the metal wire, preventing the accident from spreading.
[0015] The control IEDs 6-1 to 6-M convert analog data obtained from the instruments 9 into primary instrument values and send them out for transmission on the station bus 11. The control IEDs also send out equipment statuses for station bus transmission. The control IED 6 receives equipment control commands from the gateway (hereinafter GW) 5 and direct operation PC (hereinafter SC) 4 via station bus transmission, and sends out control commands via process bus transmission to the MU 8 connected to the target equipment. In accordance with the commands, the MU 8 turns the target equipment on or off via the metal wire.
[0016] SC4 is a monitoring and control device for direct control when the GW is not in use, and when the GW is not in use, the control right is transferred from GW3 to SC4, making it possible to monitor the measurement values and equipment status in the substation from the control IED6 received from the station bus transmission. It also makes it possible to operate equipment to stop the system for equipment inspection, etc. GW3 is used for remote control and remote monitoring from the control station system 2 outside the substation, and the implemented functions are equivalent to those of SC4.
[0017] During normal operation, the spare IED 7 does not perform monitoring and control of the digital substation system 1 or protective relay-related behavior, but monitors the transmission status between the protection IED 5 and the control IED and MU 8, and if an abnormality occurs in any of the IEDs, it can switch to an alternative IED. Also, when the cause of the abnormality in the IED that has become abnormal is resolved, the spare IED 7 has completed its role of substituting for the abnormal IED, and can be switched back to its original state.
[0018] FIG. 2 is a block diagram showing the internal configuration of the backup IED 7 according to an embodiment of the present invention.
[0019] The spare IED 7 has a CPU 21, a ROM 23, and a RAM 24, which are connected via an internal bus 22. The ROM 23 in the spare IED 7 compresses and stores all of the programs, including a protection program (for memory) 26 of the protection IED 5, a control program (for memory) 27 of the control IED 6, and a spare IED program (for memory) 25 of the spare IED 7, shown in FIG.
[0020] 2, a protection IED1 program to a protection IEDN program are stored as the protection program (for memory) 26. These are compressed programs for operating the spare IED 7 as substitute IEDs for the protection IEDs 5-1 to 5-N, respectively, and are compressed programs equivalent to those that operate in the protection IEDs 5-1 to 5-N, respectively, for example.
[0021] 2, the control IED1 program to the control IEDM program are stored as the control program (for memory) 27. These are compressed programs for operating the spare IED7 as substitute IEDs for the control IED6-1 to the control IED6-M, respectively, and are compressed programs equivalent to those that operate in the control IED6-1 to the control IED6-M, respectively, for example.
[0022] When the system is normal, the backup IED program (operation) 28 obtained by decompressing a compressed file is stored in the RAM 24 and is operated while being loaded into the CPU 21. The backup IED program 28 is a simple program that does not affect the system.
[0023] In addition, the RAM 24 stores an abnormality / recovery detection program 30 so that the standby IED 7 can monitor the transmission status between the protection IED 5 and the control IED 6 and the MU 8 , and the program is loaded into the CPU 21 .
[0024] As an example, if the protection IED5-1 becomes abnormal, the CPU 21 issues a command to the RAM 24 to decompress the protection IED1 program (for memory) 26 stored in the ROM 23 and overwrite the write area of the backup IED program 28 in the RAM 24. After confirming that the protection IED1 program (operation) 29 obtained by decompressing the protection IED1 program (for memory) 26 has been overwritten in the RAM 24, the CPU 21 loads the protection IED1 program 29 and refreshes it after loading.
[0025] FIG. 3 is a flowchart showing an example of the operation of the backup IED 7 according to an embodiment of the present invention.
[0026] 3 illustrates, as a specific example, a recovery response in the event of an abnormality in the protection IED 1, using an abnormality / recovery detection program 30 implemented in the backup IED 7. The backup IED 7 constantly recognizes the transmission status between each protection IED 5 and each control IED 6 and each MU 8 (step 31). For example, information indicating which protection IED 5 or control IED 6 each MU 8 is transmitting to or receiving from may be transmitted from each MU 8 to the backup IED 7 via process bus transmission, and the backup IED 7 may recognize which IEDs are transmitting to or receiving from based on that information.
[0027] Next, the backup IED 7 determines whether the protection IED 5-1 is connected to more than two devices (step 32). If the protection IED 5-1 is connected to two devices, it determines whether both of those devices are abnormal (step 34). The purpose of this is to determine that the protection IED 5-1 is abnormal only when abnormality information is received from both devices, since when an IED transmits and receives from two devices, it cannot be determined that an abnormality is on the IED side based on abnormality information from only one of the devices. The reason for using the AND condition for two devices is to prevent the backup IED 7 from erroneously determining that the protection IED 5-1 is abnormal if the CPU of the MU connected to the protection IED 5-1 stops or becomes abnormal.
[0028] In addition, when the protection IED 5-1 is connected to more than two devices, the backup IED 7 performs majority voting and determines that an abnormality exists on the IED side if the number of abnormality judgments is equal to or greater than the number of normality judgments (step 33). In this majority voting, if the number of abnormality judgments and the number of normality judgments are the same, the number of abnormality judgments takes precedence and determines that an abnormality exists.
[0029] The backup IED 7 may, for example, monitor packets transmitted and received via the process bus 12, and if there is an IED that does not respond to a packet from the MU 8, detect an abnormality in transmission with that IED. For example, if the transmission and reception partner of MU 8-1 is recognized in step 31 as the protection IED 5-1, and a packet addressed to MU 8-1 is not transmitted from the protection IED 5-1 to MU 8-1 despite the fact that MU 8-1 has transmitted a packet addressed to the protection IED 5-1, the backup IED 7 may detect an abnormality in transmission between MU 8-1 and the protection IED 5-1. Alternatively, in such a case, MU 8-1 may notify the backup IED 7 of an abnormality in transmission between the protection IED 5-1, and the backup IED 7 may detect an abnormality in transmission between MU 8-1 and the protection IED 5-1 based on that.
[0030] In the example conditions shown in Fig. 3, the protection IED5-1 transmits and receives data to two devices, MU8-1 and MU8-2. In this case, when the backup IED7 receives abnormality information from both of these two devices, it determines that the protection IED1 is abnormal, and checks whether the current program of the backup IED7 is the backup IED program 28 (step 35). The purpose of this is that if another program has already been loaded, the program rewrite process cannot be performed, and in this case the process ends (step 37).
[0031] If the digital substation system 1 contains only one spare IED 7, then only one IED can be replaced; however, as an expanded function, if multiple spare IEDs 7 are installed and operated, a priority can be set on the spare IED 7, so that an IED determined to be abnormal can be replaced in order, starting with the spare IED 7 with the lowest priority.
[0032] In step 37, if it is confirmed that the current program already loaded is the backup IED program 28, the backup IED 7 decompresses the protection IED 1 program 26 recorded in ROM 23, overwrites the decompressed protection IED 1 program 29 to RAM 24, and after the rewriting is complete, loads it into the CPU 21, and after the loading is complete, performs a CPU refresh (step 36).
[0033] After the refresh, when CPU 21 runs normally, the spare IED 7 connects to MU 8 on the process bus transmission side and to SC 4 and GW 3 on the station bus transmission side, so that the spare IED 7 operates in place of the protective IED 5-1, and the digital substation system 1 is restored.
[0034] After a certain period of time has passed, an operation and maintenance technician will visit the substation to restore the protection IED 5-1 by replacing the circuit board that caused the abnormality. During the restoration operation, the power supply to the protection IED 5-1 is temporarily cut off and then turned back on, starting up the CPU (not shown) of the protection IED 5-1, and after startup is complete, the protection IED 5-1 sends an initial packet (i.e., the first packet when the CPU starts normal calculation processing) to each MU 8 and the standby IED 7 via program bus transmission. The standby IED 7 receives this initial packet via process bus transmission (step 38).
[0035] When the spare IED 7 receives the initial packet, it checks whether the current program of the spare IED 7 is the protection IED 1 program 29 (step 39).
[0036] If the current program is the protection IED1 program 29, the spare IED 7 cuts off transmission with the MU 8, decompresses the spare IED program 25 recorded in the ROM 23, and overwrites the decompressed spare IED program 28 into the RAM 24. After overwriting into the spare IED program 28 is complete, it is loaded into the CPU, and after loading is complete, a CPU refresh is performed (step 40). This ends the execution of the protection IED1 program 29, and as a result, the operation of the spare IED 7 substituting for the protection IED 5-1 is completed.
[0037] After the refresh, when the CPU 21 of the spare IED 7 runs normally, the spare IED 7 does not perform monitoring and control of the digital substation system 1 or protective relay-related behavior as in the conventional manner, but monitors the transmission status between the protection IED 5 and the control IED 6 and the MU 8.
[0038] In addition, after transmission between standby IED7 and MU8 is cut off, protective IED5-1, which has been restored, connects to MU8 on the process bus transmission side and to SC4 and GW3 on the station bus transmission side, thereby recovering as a system.
[0039] Furthermore, the system according to the embodiment of the present invention may be configured as follows.
[0040] (1) A standby protection control device (e.g., standby IED 7) is connected to a plurality of merging units (e.g., MU 8) and a plurality of protection control devices (e.g., protection IED 5 and control IED 6), each of the merging units is connected to at least one of an instrument (e.g., instrument 9) that measures a power system and an apparatus (e.g., apparatus 10) that controls the power system, each of the protection control devices has a function of communicating with at least one of the merging units and performing a calculation for protecting or controlling the power system, the standby protection control device has a processor (e.g., CPU 21) and a memory (e.g., ROM 23 and RAM 24), and the memory is connected to the plurality of protection control devices. The processor holds multiple protection and control programs (e.g., a protection IED program 26 and a control IED program 27) for realizing each function of the device, and when the processor detects an abnormality in any of the multiple protection and control devices, it determines whether the protection and control program for realizing the functions of the protection and control device other than the protection and control device that detected the abnormality is being executed (e.g., step 35), and if the protection and control program for realizing the functions of the protection and control device other than the protection and control device that detected the abnormality is not being executed, it starts execution of the protection and control program for realizing the functions of the protection and control device that detected the abnormality (e.g., step 36).
[0041] This makes it possible to ensure system reliability as a single system and reduce costs by preparing one or a small number of spare IEDs for multiple protection IEDs and multiple control IEDs, without having to separate the protection IEDs and control IEDs into two systems.
[0042] (2) In the backup protection control device described in (1) above, when the processor receives a specified packet (e.g., an initial packet) from the protection control device that detected the abnormality, it determines whether the protection control program for realizing the function of the protection control device that detected the abnormality is being executed (e.g., step 39), and if the protection control program for realizing the function of the protection control device that detected the abnormality is being executed, it terminates its execution (e.g., step 40).
[0043] This allows a protection or control IED that has experienced an abnormality to be switched back when it is restored.
[0044] (3) A backup protection control device as described in (2) above, wherein the processor detects a transmission state between each of the plurality of protection control devices and the plurality of merging units, and detects an abnormality in each of the plurality of protection control devices based on the transmission state (e.g., steps 33, 34).
[0045] This enables abnormalities in the protection and control device to be detected appropriately.
[0046] (4) In the standby protection control device described in (3) above, the processor identifies the merging unit that is the transmission / reception partner with each of the multiple protection control devices (e.g., step 31), and when an abnormality is detected in transmission with either of the two identified merging units for a protection control device among the multiple protection control devices that has two of the merging units identified as transmission / reception partners among the multiple protection control devices, the processor detects an abnormality in the protection control device (e.g., steps 32, 34), and when an abnormality is detected in transmission with more than half of the three or more identified merging units for a protection control device among the multiple protection control devices that has three or more merging units identified as transmission / reception partners among the multiple protection control devices, the processor detects an abnormality in the protection control device (e.g., steps 32, 33).
[0047] This enables abnormalities in the protection and control device to be detected appropriately.
[0048] (5) A backup protection control device as described in (3) above, wherein the backup protection control device is connected to the multiple merging units and the multiple protection control devices via a bus (e.g., process bus 12), and the processor monitors packets transmitted and received via the bus, and if the protection control device does not respond to a packet transmitted from the merging unit, detects an abnormality in transmission between the merging unit and the protection control device.
[0049] This enables abnormalities in the protection and control device to be detected appropriately.
[0050] The present invention is not limited to the above-mentioned embodiment, and various modifications are included. For example, the above-mentioned embodiment has been described in detail for better understanding of the present invention, and is not necessarily limited to those having all the configurations described. Also, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Also, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.
[0051] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as a program, table, file, etc. that realizes each function can be stored in a storage device such as a non-volatile semiconductor memory, a hard disk drive, or an SSD (Solid State Drive), or in a computer-readable non-transitory data storage medium such as an IC card, an SD card, or a DVD.
[0052] In addition, the control lines and information lines are shown as those considered necessary for the explanation, and not all control lines and information lines in the product are shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]
[0053] 1. Digital substation system 2. Remote control system 3. Gateway (GW) 4...Direct operation PC (SC) 5-1~N…Protection IED 6-1~M…Control IED 7. Backup IED 8-1~L…MU 9…Measurement (PT, CT) 10…Equipment (CB, LS) 11…Station bus 12...Process bus 21…CPU 22…Internal bus 23...ROM 24…RAM 25…Backup IED program (for memory) 26…Protection program (for memory) 27...Control program (for memory) 28... Reserve IED Program (Operational) 29...Protective IED1 Program (Operation) 30...Abnormality / Recovery Detection Program
Claims
1. A backup protection control device, A system is connected to a plurality of merging units and a plurality of protection and control devices, Each of the merging units is connected to at least one of an instrument that measures the power system and an instrument that controls the power system, Each of the protection and control devices has a function of communicating with at least one of the merging units and performing calculations for protecting or controlling the power system, The backup protection control device has a processor and a memory, The memory holds a plurality of protection and control programs for implementing functions of each of the plurality of protection and control devices, The processor, When an abnormality is detected in any of the plurality of protection and control devices, it is determined whether the protection and control program for realizing the function of the protection and control device other than the protection and control device that detected the abnormality is being executed; A backup protection control device characterized in that, when a protection control program for realizing the functions of a protection control device other than the protection control device that detected the abnormality is not being executed, execution of the protection control program for realizing the functions of the protection control device that detected the abnormality is started.
2. 2. The backup protection control device according to claim 1, The processor, When a predetermined packet is received from the protection control device that detected the abnormality, it is determined whether the protection control program for realizing the function of the protection control device that detected the abnormality is being executed; A backup protection control device characterized in that, when the protection control program for realizing the function of the protection control device that detected the abnormality is being executed, the execution of the protection control program is terminated.
3. The backup protection control device according to claim 2, The processor detects a transmission state between each of the plurality of protection control devices and the plurality of merging units, and detects an abnormality in each of the plurality of protection control devices based on the transmission state.
4. The backup protection control device according to claim 3, The processor, Identifying the merging unit that is a transmission / reception partner with each of the plurality of protection and control devices; Among the plurality of protection control devices, for a protection control device in which two merging units are specified as transmission / reception partners, when an abnormality is detected in transmission with either of the two specified merging units, an abnormality is detected in the protection control device; A backup protection control device characterized by detecting an abnormality in a protection control device that has three or more merging units identified as transmission / reception partners among the multiple protection control devices, when an abnormality is detected in transmission with more than half of the three or more identified merging units.
5. The backup protection control device according to claim 3, The backup protection control device is connected to the plurality of merging units and the plurality of protection control devices via a bus, The processor monitors packets transmitted and received via the bus, and if the protection control device does not respond to a packet sent from the merging unit, detects an abnormality in transmission between the merging unit and the protection control device.
6. A method for detecting and recovering from an abnormality using a standby protection control device, comprising: The backup protection control device is connected to a plurality of merging units and a plurality of protection control devices, Each of the merging units is connected to at least one of an instrument that measures the power system and an instrument that controls the power system, Each of the protection and control devices has a function of communicating with at least one of the merging units and performing calculations for protecting or controlling the power system, The backup protection control device has a processor and a memory, The memory holds a plurality of protection and control programs for implementing functions of each of the plurality of protection and control devices, The abnormality detection and recovery method includes: When the processor detects an abnormality in any of the plurality of protection control devices, a first step of determining whether the protection control program for realizing the function of the protection control device other than the protection control device that detected the abnormality is being executed; A method for detecting and recovering from an anomaly, comprising: a second step in which, when the protection control program for realizing the function of a protection control device other than the protection control device that detected the abnormality is not being executed, the processor starts execution of the protection control program for realizing the function of the protection control device that detected the abnormality.
7. The anomaly detection and recovery method according to claim 6, A third step of determining whether the protection control program for implementing the function of the protection control device that detected the abnormality is being executed when the processor receives a predetermined packet from the protection control device that detected the abnormality; and a fourth step of terminating the execution of the protection control program when the protection control program for realizing the function of the protection control device that detected the abnormality is being executed.
8. The anomaly detection and recovery method according to claim 7, An abnormality detection and recovery method characterized in that, in the first step, the processor detects a transmission state between each of the multiple protection and control devices and the multiple merging units, and detects an abnormality in each of the multiple protection and control devices based on the transmission state.
9. The method for detecting and recovering from an anomaly according to claim 8, In the first step, the processor Identifying the merging unit that is a transmission / reception partner with each of the plurality of protection and control devices; Among the plurality of protection control devices, for a protection control device in which two merging units are specified as transmission / reception partners, when an abnormality is detected in transmission with either of the two specified merging units, an abnormality is detected in the protection control device; An abnormality detection and recovery method characterized by detecting an abnormality in a protection control device that has three or more merging units identified as transmission / reception partners among the multiple protection control devices, when an abnormality is detected in transmission with more than half of the three or more identified merging units.
10. The method for detecting and recovering from an anomaly according to claim 8, The backup protection control device is connected to the plurality of merging units and the plurality of protection control devices via a bus, An anomaly detection and recovery method characterized in that, in the first step, the processor monitors packets transmitted and received via the bus, and if the protection control device does not respond to a packet sent from the merging unit, detects an anomaly in the transmission between the merging unit and the protection control device.
11. A protection and control system, comprising: A system including a plurality of merging units, a plurality of protection control devices, and one or more standby protection control devices connected to the plurality of merging units and the plurality of protection control devices, The number of the backup protection control devices is less than the number of the protection control devices, Each of the merging units is connected to at least one of an instrument that measures the power system and an instrument that controls the power system, Each of the protection and control devices has a function of communicating with at least one of the merging units and performing calculations for protecting or controlling the power system, The backup protection control device has a processor and a memory, The memory holds a plurality of protection and control programs for implementing functions of each of the plurality of protection and control devices, The processor, When an abnormality is detected in any of the plurality of protection and control devices, it is determined whether the protection and control program for realizing the function of the protection and control device other than the protection and control device that detected the abnormality is being executed; A protection and control system characterized in that, when the protection and control program for realizing the functions of a protection and control device other than the protection and control device that detected the abnormality is not being executed, execution of the protection and control program for realizing the functions of the protection and control device that detected the abnormality is started.
Citation Information
Patent Citations
Multiprocessor signal processing unit
JP2006085246A
Protection and control system
JP2010068594A