Multi-system control system and power conversion system including the same

Abstract

The control system (20) includes a first control device (202A) and a second control device (202B). The first control device (202A) includes an electrical contact (217A), an operation circuit (220A), and a first control circuit (230A). The first control circuit (230A) selectively takes a first state or a second state. The second control device (202B) includes a second control circuit (230B) that takes a first state or a second state complementarily to the first control circuit (230A). When the first control circuit (230A) detects an abnormality in the first control circuit (230A), the first control circuit (230A) transmits abnormality information indicating the type of the abnormality to the second control circuit (230B). The abnormality information includes first information indicating that the abnormality is a software error. In response to the reception of the first information from the first control circuit (230A), the second control circuit (230B) executes opening / closing control to control the operation circuit (220A) to open and then close the electrical contact (217A).

Description

[Technical field]

[0001] The present disclosure relates to a multi-system control system and a power conversion system including the same. [Background technology]

[0002] Japanese Patent Laid-Open Publication No. 2014-241679 (Patent Document 1) discloses a multiplexed control system. This multiplexed control system includes multiple control devices (control circuits) and is used, for example, to improve the reliability of a power system. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-241679 Summary of the Invention [Problem to be solved by the invention]

[0004] In a multiplexed control system, each control circuit selectively assumes either a state in which it controls an object (operating state) or a state in which it stands by without controlling the object (standby state). For example, if a first control circuit detects an abnormality in the first control circuit itself while in the operating state, the first control circuit switches from the operating state to the standby state, and the second control circuit switches from the standby state to the operating state. When an abnormality occurs in the first control circuit, a user can go to the location where the first control circuit is installed, confirm the abnormal state of the first control circuit, and take appropriate countermeasures (for example, repair by replacing parts). However, going to the location where the first control circuit is installed and taking countermeasures every time an abnormality occurs requires a lot of effort and time.

[0005] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to resolve an abnormality early while saving the user effort when an abnormality occurs in a control circuit of a multiple-system control system. [Means for solving the problem]

[0006] The multiplexed control system disclosed herein includes a first control device and a second control device, each capable of controlling an object. The first control device includes an electrical contact, an operating circuit, and a first control circuit. The electrical contact is provided on a power supply line. The operating circuit operates the electrical contact. The first control circuit has a first memory for storing software, and when the electrical contact is in a closed state, receives power supplied through the power supply line and selectively assumes either a first state or a second state. The first state is a state in which the object is controlled. The second state is a standby state without controlling the object. The second control device includes a second control circuit that assumes either the first state or the second state complementary to the first control circuit. When the first control circuit detects an abnormality in the first control circuit, the first control circuit transmits abnormality information indicating the type of abnormality to the second control circuit. The abnormality information includes first information indicating that the abnormality is a software error. In response to receiving the first information from the first control circuit, the second control circuit performs opening and closing control, controlling the operating circuit to open and then close the electrical contact. [Effects of the Invention]

[0007] According to the present disclosure, when an abnormality occurs in a control circuit of a multiplexed control system, the abnormality can be resolved early while saving the user's effort. [Brief description of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating a configuration of a power conversion system to which a multiplexed control system according to an embodiment of the present invention is applied. [Figure 2] FIG. 2 is a diagram illustrating a detailed configuration of the control system. [Diagram 3] FIG. 10 is a diagram illustrating a process executed when an abnormality occurs in the control circuit. [Figure 4] 4 is a flowchart illustrating a process executed by a control circuit in the embodiment. [Diagram 5] FIG. 10 is a diagram illustrating a configuration of a control system according to a first modified example. [Figure 6]It is a flowchart exemplifying the processes executed by the control circuit in Modification 1. [Figure 7] It is a diagram showing the configuration of the control system according to Modification 2.

Mode for Carrying Out the Invention

[0009] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. The same or corresponding parts in the drawings are denoted by the same reference numerals and their description will not be repeated. Each of the embodiments and their modifications may be combined with each other as appropriate.

[0010] In the present disclosure, when an element (first element) is described as being "connected" between another element (second element) and still another element (third element), a fourth element may be interposed between the first element and the second element, or between the first element and the third element, or the first element may be directly connected to the second element or the third element without the fourth element. Similarly, when the first element is described as being "connected" to the second element, a fourth element may be interposed between the first element and the second element, or the first element may be directly connected to the second element without the fourth element.

[0011] FIG. 1 is a diagram showing the configuration of a power conversion system to which a multi-system control system according to the present embodiment is applied. Referring to FIG. 1, the power conversion system 1 is applied to, for example, a static var compensator (SVC) or a high voltage direct current (HVCD) power transmission system. The power conversion system 1 includes a power conversion device 10 and a control system 20.

[0012] The power conversion device 10 is connected between power lines 32 and 34. The power lines 32 and 34 are, for example, power transmission cables of a power grid. The power conversion device 10 converts the voltage of the power line 32 (for example, step - down) and supplies the power of the converted voltage to the power line 34. The power conversion device 10 includes a switching element 105. The switching element 105 is incorporated in the main conversion circuit (not shown) of the power conversion device 10.

[0013] The control system 20 is a multi - system control system and includes a plurality of control devices. Each control device is configured to be controllable through a control signal CS for the power conversion device 10 (specifically, the switching element 105) as its control object.

[0014] FIG. 2 is a diagram showing the detailed configuration of the control system 20. Referring to FIG. 2, the control system 20 includes power lines 201A, 201B, control devices (control panels) 202A, 202B, and a display device 205.

[0015] The power line 201A is connected to the power supply PS and transmits power from the power supply PS to the control device 202A. The control device 202A includes power lines 206A, 207A, 209A, a circuit breaker 210A, a switch 215A, an operation circuit 220A, and a control circuit 230A.

[0016] The circuit breaker 210A is connected between the power lines 201A and 206A and includes an electrical contact 212A. The power line 206A is connected between the circuit breaker 210A and the switch 215A. The electrical contact 212A is a mechanical contact provided upstream of the switch 215A on the power supply line PLA. The open state and the closed state of the circuit breaker 210A correspond to the open state and the closed state of the electrical contact 212A, respectively.

[0017] The power line PLA is a power supply path from the power supply PS to the control circuit 230A. Specifically, it is a circuit formed by power lines 201A, 206A, 209A, as well as the circuit breaker 210A and the switch 215A. When the circuit breaker 210A is in the closed state and an overcurrent flows through the power lines 201A and 206A, the circuit breaker 210A is automatically opened. Thereby, the overcurrent is cut off. In the following description, unless otherwise specified, the circuit breaker 210A is assumed to be in the closed state.

[0018] The switch 215A is connected between the power lines 206A and 209A and includes an electrical contact 217A. The electrical contact 217A is a mechanical contact provided on the power line PLA. The open state and the closed state of the switch 215A correspond to the open state and the closed state of the electrical contact 217A, respectively. Each of the electrical contact 212A and the electrical contact 212B (described later) forms an example of the "electrical contact" of the present disclosure.

[0019] The operation circuit 220A is connected to the power line 206A through the power line 207A. The operation circuit 220A operates by receiving power supplied from the power supply PS through the power lines 201A, 206A, and 207A when the circuit breaker 210A is in the closed state. The operation circuit 220A is configured to operate (specifically, open or close) the electrical contact 217A. The operation circuit 220A includes a capacitor (not shown).

[0020] The control circuit 230A receives the operating power supplied from the power supply PS through the power line PLA when the circuit breaker 210A and the switch 215A are in the closed state, and selectively takes either an operating state or a standby state. The operating state is a state in which the power conversion device 10 (FIG. 1) is controlled through the control signal CS. The standby state is a state in which the power conversion device 10 is waited for backup without control.

[0021] The control circuit 230A includes a memory unit 235A, a detection unit 240A, a communication unit 245A, and a control unit 247A. Each of the detection unit 240A, the communication unit 245A, and the control unit 247A is a dedicated processing circuitry such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0022] The memory unit 235A is a volatile memory that stores the software SWA. The detection unit 240A detects an abnormality in the control circuit 230A when the abnormality occurs, and generates an abnormality signal SGA. The abnormality signal SGA includes information indicating the type of the abnormality in the control circuit 230A. Specifically, this information indicates whether the abnormality in the control circuit 230A is an error in the software SWA (hereinafter, also simply referred to as a "software error") or an abnormality other than the error (in one example, a hardware failure in the control circuit 230A). In the following description, the software error is assumed to be data corruption of the software SWA. The communication unit 245A communicates with the control device 202B.

[0023] The control unit 247A is configured to control the communication unit 245A. The control unit 247A controls the communication unit 245A to transmit the status information SIA to the control device 202B. The status information SIA indicates the status of the control circuit 230A. Specifically, the status information SIA indicates whether the control circuit 230A is in an operating state or a standby state.

[0024] When an abnormal signal SGA is generated, the control unit 247A controls the communication unit 245A to also transmit abnormal information AIA to the control circuit 230B. The abnormal information AIA is generated based on the abnormal signal SGA and indicates the type of abnormality in the control circuit 230A. Specifically, the abnormal information AIA is either software error information IA1 or non-software error information IA2. The software error information IA1 indicates that the abnormality in the control circuit 230A is a software error. The non-software error information IA2 indicates that the abnormality in the control circuit 230A is different from a software error.

[0025] The control device 202B has the same configuration as the control device 202A. Specifically, the control device 202B includes power lines 206B, 207B, 209B, a circuit breaker 210B, a switch 215B, an operation circuit 220B, and a control circuit 230B.

[0026] The circuit breaker 210B is connected between the power lines 201B and 206B and includes an electrical contact 212B. The switch 215B is connected between the power lines 206B and 209B and includes an electrical contact 217B. The circuit breaker 210B and the switch 215B are provided on the power line PLB. The power line PLB is a power supply path from the power supply PS to the control circuit 230B. The operation circuit 220B is configured to operate the electrical contact 217B.

[0027] The control circuit 230B receives operating power supplied from the power supply PS through the power line PLB and takes either an operating state or a standby state complementarily to the control circuit 230A. For example, when the control circuit 230A is in the operating state, the control circuit 230B is in the standby state. On the other hand, when the control circuit 230A is in the standby state, the control circuit 230B is in the operating state.

[0028] The control circuit 230B includes a memory unit 235B, a detection unit 240B, a communication unit 245B, and a control unit 247B. Each of the detection unit 240B, the communication unit 245B, and the control unit 247B is a dedicated processing circuit such as an ASIC or an FPGA.

[0029] The memory unit 235B is a volatile memory that stores the software SWB. The detection unit 240B detects an abnormality in the control circuit 230B and generates an abnormality signal SGB. The abnormality signal SGB indicates the type of abnormality in the control circuit 230B. Specifically, the abnormality signal SGB indicates whether the abnormality in the control circuit 230B is an error in the software SWB or an abnormality other than the software SWB error. The communication unit 245B communicates with the control device 202A.

[0030] The control unit 247B controls the communication unit 245B to transmit status information SIB to the control device 202A. The status information SIB indicates the status of the control circuit 230B. Specifically, the status information SIB indicates whether the control circuit 230B is in the operating state or the standby state described above.

[0031] When the abnormality signal SGB is generated, the control unit 247B controls the communication unit 245B to also transmit abnormality information AIB to the control device 202A. The abnormality information AIB is generated based on the abnormality signal SGB and includes information indicating the type of abnormality in the control circuit 230B. Specifically, the abnormality information AIB is either software error information IB1 or non-software error information IB2. The software error information IB1 indicates that the abnormality in the control circuit 230B is a software SWB error. The non-software error information IB2 indicates that the abnormality in the control circuit 230A is different from a software SWB error.

[0032] The control unit 247B can also control the communication unit 245B to transmit an opening command SA1 or a closing command SA2 to the operation circuit 220A. The opening command SA1 is a signal that commands the operation circuit 220A to open the switch 215A. The closing command SA2 is a signal that commands the operation circuit 220A to close the switch 215A.

[0033] The control circuits 230A and 230B monitor each other by exchanging abnormality information AIA, AIB and status information SIA, SIB between these circuits.

[0034] The display device 205 functions as a notification device that notifies the user of various information (for example, an abnormality in the control circuit 230A or 230B). The display device 205 is controlled by either of the control circuits 230A and 230B.

[0035] When an abnormality occurs in the control circuit 230A or 230B, the user can go to the installation location of the control circuit where the abnormality has occurred, check the abnormal state of the control circuit, and take appropriate countermeasures. This countermeasure is, for example, repair by replacing parts. However, going to the installation location of the control circuit every time an abnormality occurs and taking countermeasures requires a lot of labor and time. And since the control circuit cannot operate normally until the abnormality is resolved, the multiplicity (redundancy) of the control system 20 can be impaired over a long period of time. This is not preferable from the viewpoint of the reliability of the control system 20.

[0036] Therefore, the control system 20 according to the embodiment has a configuration for dealing with the above problems. This will be described below.

[0037] FIG. 3 is a diagram for explaining the processing executed when an abnormality occurs in the control circuit 230A. In this example, it is assumed that the abnormality in the control circuit 230A is a software error.

[0038] Referring to FIG. 3, the control circuit 230B receives the software error information IA1 as the abnormality information AIA from the control device 202A. In response to the reception of the software error information IA1, the control circuit 230B executes opening / closing control of the switch 215A. This opening / closing control corresponds to controlling the operation circuit 220A so as to open the switch 215A (specifically, the electrical contact 217A) and then close it. Specifically, this opening / closing control corresponds to a process of transmitting an opening command SA1 to the operation circuit 220A through the communication unit 245B and transmitting a closing command SA2 to the operation circuit 220A after a predetermined time has elapsed. The predetermined time is determined in advance by experiments or the like, for example, as the time from the transmission of the opening command SA1 until the discharge of the capacitor in the operation circuit 220A is completed.

[0039] Due to the miniaturization of various IC components on the board of the control circuit 230A, software errors such as data corruption are likely to occur. Such software errors can cause malfunctions in the control circuit 230A, but can be resolved by turning on the power of the control circuit 230A (shutdown and restart).

[0040] According to the above opening and closing control, the switch 215A is automatically opened and closed upon detection of a software error. As a result, the electrical connection between the control circuit 230A and the power supply PS is temporarily interrupted and then re-established, so that the supply of operating power from the power line PLA to the control circuit 230A is temporarily stopped and then resumed. As a result, the control circuit 230A is automatically powered on (shutdown and then restarted). Therefore, when the abnormality of the control circuit 230A is a software error, this error can be automatically resolved. Thus, the user does not need to go to the installation location of the control circuit 230A every time an abnormality occurs in the control circuit 230A to check the abnormal state and take countermeasures. As a result, the labor of the user can be saved.

[0041] Furthermore, since the aforementioned predetermined time is generally very short, the time required for the opening and closing control is also very short. Therefore, according to the opening and closing control, the control circuit 230A is powered on in a very short time. As a result, the software error is resolved earlier compared to the case where the user goes to the installation location of the control circuit 230A and manually opens and closes the circuit breaker 210A etc. for powering on the control circuit 230A. Therefore, the multiplicity of the control system 20 can be restored earlier, and the reliability of the control system 20 can be improved.

[0042] When the control circuit 230B receives non-software error information IA2 from the control circuit 230A, the control circuit 230B controls the display device 205 to notify the user of the abnormality of the control circuit 230A. The control circuit 230B controls the display device 205 to notify the user, for example, that repair such as component replacement is necessary because a hardware failure has occurred.

[0043] With such a configuration, the user is motivated to take appropriate countermeasures at the installation location of the control circuit 230A. As a result, hardware failures and the like of the control circuit 230A can be eliminated by replacing parts or the like. When the abnormality is a software error, the control circuit 230B executes the above-described opening / closing control without notifying the fact. Thereby, a situation where the number of notifications increases unnecessarily is avoided.

[0044] The opening / closing control may be executed in either the first case or the second case described below.

[0045] In the first case, immediately before the software error, the control circuit 230A is in the operating state and the control circuit 230B is in the standby state. When the abnormal signal SGA indicates a software error, the control circuit 230A switches from the operating state to the standby state. Then, the control circuit 230A includes information indicating the change of its state in the state information SIA and transmits the state information SIA together with the abnormal information AIA to the control circuit 230B.

[0046] In response to the reception of the state information SIA, the control circuit 230B switches from the standby state to the operating state and, in response to the reception of the abnormal information AIA, executes the opening / closing control. After the opening / closing control, when the control circuit 230A is powered on and the abnormal signal SGA indicating a software error is no longer generated, the control circuit 230A determines that the software error has been resolved. The control circuit 230A notifies the control circuit 230B of the result of this determination.

[0047] In response to the notification from the control circuit 230B, the control circuit 230B switches from the operating state to the standby state. In this case, the control circuit 230B includes information indicating the change of its state in the state information SIB and transmits the state information SIB to the control circuit 230A. In response to the reception of the state information SIB, the control circuit 230A switches from the standby state to the operating state.

[0048] In the second case, immediately before the software error, the control circuit 230A is in a standby state and the control circuit 230B is in an operating state. When the abnormality signal SGA indicates a software error, the control circuit 230A continues to be in a standby state and transmits abnormality information AIA to the control circuit 230B. In this case, the control circuit 230B continues to be in an operating state and performs opening and closing control.

[0049] Thus, in both the first and second cases, after a software error is detected, control circuit 230A is in a standby state and control circuit 230B is in an operating state unless the software error is resolved.

[0050] Another advantage of the embodiment will be described below. As described above, the operation circuit 220A opens and closes the switch 215A instead of the circuit breaker 210A. Then, in the event of a software error, the control circuit 230B executes the opening and closing control of the switch 215A.

[0051] According to such switching control, the electrical connection between the power lines 201A and 206A is maintained even after the switch 215A is opened, and as a result, the operating circuit 220A can continue to operate by receiving power from the power source PS through the power lines 201A, 206A, and 207A.

[0052] Suppose that the circuit breaker 210A can be operated using the operating circuit 220A, and that the circuit breaker 210A is opened using the operating circuit 220A in the event of a software error. In this case, the power supply from the power source PS to the control circuit 230A is stopped, the control circuit 230A is powered off, and the operating circuit 220A may also become inoperable. As a result, the circuit breaker 210A cannot be automatically closed in accordance with the closing command SA2 using the operating circuit 220A. Therefore, the user must manually close the circuit breaker 210A to power on the control circuit 230A and resolve the software error.

[0053] On the other hand, in the embodiment, the power supply to the operating circuit 220A is secured while maintaining the function of the circuit breaker 210A even after the switch 215A is opened. Therefore, the switch 215A can be automatically closed in accordance with the closing command SA2 from the control circuit 230B. Therefore, the user does not need to manually operate the circuit breaker 210A as described above.

[0054] 4 is a flowchart illustrating the processing executed by the control circuits 230A and 230B in this embodiment. This flowchart starts when an abnormality signal SGA is generated due to abnormality detection by the control circuit 230A. Hereinafter, steps will be abbreviated as "S."

[0055] 4, the control circuit 230A determines whether the abnormality is a software error according to the abnormality signal SGA (S105). If the abnormality is a software error (YES in S105), the control circuit 230A transmits software error information IA1 as abnormality information AIA to the control circuit 230B (S110). If the abnormality is different from a software error, for example, if it is a hardware failure (NO in S105), the control circuit 230A transmits non-software error information IA2 as the abnormality information AIA to the control circuit 230B (S115). Thereafter, the control circuit 230A controls the display device 205 to notify the user of an abnormality in the control circuit 230A itself (for example, a hardware failure) (S117). After S117, the processing ends.

[0056] The control circuit 230B determines whether or not the abnormality information AIA has been received (S220). If the control circuit 230B has not yet received the abnormality information AIA (NO in S220), the process returns. If the control circuit 230B has received the abnormality information AIA (YES in S220), the control circuit 230B determines whether or not the abnormality information AIA is software error information IA1 (S225).

[0057] If the abnormality information AIA is software error information IA1 (YES in S225), the control circuit 230B executes opening and closing control of the switch 215A (S229). Specifically, the control circuit 230B transmits an opening command SA1 to the operation circuit 220A (S230), and transmits a closing command SA2 to the operation circuit 220A after a predetermined time (S235). This causes the power to be turned off (S136), and then the power is turned on (S137). On the other hand, if the abnormality information AIA is non-software error information IA2 (NO in S225), the control circuit 230A controls the display device 205 to notify the user of an abnormality in the control circuit 230A itself (S240). After S235 and S240, the processing ends.

[0058] As described above, according to the embodiment, the control circuit 230B executes the opening and closing control of the switch 215A in response to receiving the software error information IA1 from the control circuit 230A. This allows the abnormality to be resolved early when a software error occurs while saving the user's effort.

[0059] Referring back to FIG. 2, when an error is detected in the software SWA of the control circuit 230A, the control circuit 230B executes the opening and closing control of the switch 215A using the operation circuit 220A. On the other hand, when an error is detected in the software SWB of the control circuit 230B, the control circuit 230A may execute the opening and closing control of the switch 215B using the operation circuit 220B. This opening and closing control corresponds to a process of transmitting an opening command SB1 to the operation circuit 220B via the communication unit 245A, and then transmitting a closing command SB2 to the operation circuit 220B after a predetermined time has elapsed. The opening command SB1 is a signal instructing the operation circuit 220B to open the switch 215B. The closing command SB2 is a signal instructing the operation circuit 220B to close the switch 215B. According to the above opening and closing control by the control circuit 230A, when an error in the software SWB of the control circuit 230B is detected, the error can be automatically and quickly resolved.

[0060] [Variation 1] Referring to FIG. 3 again, when the control circuit 230B receives the software error information IA1 from the control circuit 230A, it may determine whether to execute the opening / closing control of the switch 215A according to the number of times of the opening / closing control of the switch 215A that has been executed within the most recent period. The most recent period refers to the period from a predetermined time before the current time to the current time. The predetermined time is, for example, 5 minutes.

[0061] For example, when the above-mentioned number is large, it is possible that the software error was not eliminated by one opening / closing control of the switch 215A, and thus the opening / closing control was repeatedly executed unintentionally several times thereafter. Continuing to repeat the opening / closing control in this way may cause wear of the electrical contact 217A of the switch 215A.

[0062] Therefore, in Modification 1, when the above-mentioned number is large, the control circuit 230B no longer executes (forbids) the opening / closing control of the switch 215A, and executes the opening / closing control only when the above-mentioned number is small. As a result, it is possible to prevent the opening / closing control from being repeatedly executed unintentionally. As a result, the electrical contact 217A of the switch 215A can be appropriately protected from wear. Hereinafter, the configuration of the control system according to Modification 1 will be specifically described.

[0063] FIG. 5 is a diagram showing the configuration of the control system according to Modification 1. Referring to FIG. 5, the control system 50 is different from the control system 20 (FIG. 2) of the embodiment in that the memory units 235A and 235B further store the count information 236A and 236B, respectively. In other respects, unless otherwise specified, the control system 50 is basically the same as the control system 20. Therefore, detailed description will not be repeated.

[0064] The count information 236A indicates the number of times of execution of the opening / closing control of the switch 215B by the control circuit 230A within the most recent period. The count information 236B indicates the number of times of execution of the opening / closing control of the switch 215A by the control circuit 230B within the most recent period.

[0065] In this example, it is assumed that a software error in the control circuit 230A has been detected. As a result, similar to the embodiment, the control circuit 230A is in a standby state and the control circuit 230B is in an operating state.

[0066] In response to receiving the software error information IA1 from the control circuit 230A, the control circuit 230B reads, from the memory unit 235B, the number of times of execution of the opening / closing control within the most recent period according to the count information 236B. The control circuit 230B determines whether the read number of times is less than a threshold value. The threshold value is, for example, a positive integer of 2 or more and is determined in advance as appropriate.

[0067] If the read number of times is less than the threshold value, the control circuit 230B executes the opening / closing control of the switch 215A using the operation circuit 220A. If the software error is resolved after this opening / closing control, the control circuit 230B may switch from the operating state to the standby state and the control circuit 230A may switch from the standby state to the operating state. Alternatively, the control circuit 230A may continue to be in the standby state and the control circuit 230B may continue to be in the operating state. On the other hand, if the read number of times has already reached the threshold value, the control circuit 230B continues the operating state without executing the opening / closing control of the switch 215A. Thereby, it is possible to prevent the opening / closing control of the switch 215A from being repeatedly performed unintentionally. As a result, it is possible to continue the control of the power conversion device 10 in the power conversion system 1 while appropriately protecting the electrical contact 217A of the switch 215A from wear.

[0068] FIG. 6 is a flowchart illustrating the processing executed by the control circuit 230B in the first modification. Referring to FIG. 6, this flowchart starts when it is determined that the abnormal information AIA is the software error information IA1 (YES in S225 of FIG. 4). Immediately after the start of this flowchart, the control circuit 230A is in a standby state and the control circuit 230B is in an operating state.

[0069] The control circuit 230B reads out the number of times that the opening and closing control has been executed within the most recent period from the memory unit 235B (S226). The control circuit 230B determines whether the read-out number is less than a threshold value (S227).

[0070] If the read number of times is less than the threshold value (YES in S227), the control circuit 230B executes the opening and closing control of the switch 215A (S226 in FIG. 4). On the other hand, if the read number of times has already reached the threshold value (NO in S227), the control circuit 230B continues the operating state without executing the opening and closing control of the switch 215A (S228). The control circuit 230B may further control the display device 205 to notify the user of a malfunction of the control circuit 230A. After S228, the processing ends.

[0071] As described above, according to Modification 1, if the switching control of switch 215A has already been repeated several times within the most recent period, control circuit 230B no longer executes the switching control of switch 215A after receiving software error information IA1 and continues the operating state. This prevents the switching control of switch 215A from being unintentionally repeated. As a result, it is possible to continue control of power conversion device 10 in power conversion system 1 while appropriately protecting electrical contact 217A of switch 215A from wear.

[0072] Referring back to FIG. 5, the control circuit 230A may execute the same process as the control circuit 230B. Specifically, in response to receiving the software error information IB1 from the control circuit 230B, the control circuit 230A may determine whether the number of times the control circuit 230A has controlled the switching of the switch 215B within the most recent period is less than a threshold value, based on the count information 236A. If the number of times the control circuit 230A has controlled the switching of the switch 215B within the most recent period has reached the threshold value, the control circuit 230A no longer controls the switching of the switch 215B. This prevents the switching of the switch 215B from being unintentionally repeated. As a result, the electrical contact 217B of the switch 215B can be appropriately protected from wear.

[0073] [Modification Example 2] In the embodiment and Modification Example 1 thereof, it is assumed that the control circuits 230A and 230B are powered on by the automatic opening and closing of the switches 215A and 215B.

[0074] In contrast, in Modification Example 2, the control circuits 230A and 230B are powered on by the automatic opening and closing of the circuit breakers 210A and 210B. As described below, in Modification Example 2, the circuit breakers 210A and 210B can be automatically closed even after they are opened.

[0075] FIG. 7 is a diagram showing the configuration of the control system according to Modification Example 2. Referring to FIG. 7, the control system 60 is different from the control system 20 (FIG. 2) of the embodiment in that it includes power lines 207AA and 207BB and control devices 202AA and 202BB instead of the power lines 207A and 207B and the control devices 202A and 202B. In other respects, the control system 60 is basically the same as the control system 20 unless otherwise specified. Therefore, detailed description will not be repeated.

[0076] The power lines 207AA and 207BB are respectively connected to the power lines 201A and 201B. The power lines 207AA and 207BB may be respectively connected to power lines (not shown) separately connected to the power supply PS from the power lines 201A and 201B.

[0077] The control device 202AA is different from the control device 202A in that it includes a power line 206AA and an operation circuit 220AA instead of the power lines 206A, 207A, 209A, the switch 215A, and the operation circuit 220A. The control device 202BB is different from the control device 202B in that it includes a power line 206BB and an operation circuit 220BB instead of the power lines 206B, 207B, 209B, the switch 215B, and the operation circuit 220B.

[0078] Power line 206AA is connected between circuit breaker 210A and control circuit 230A. Power supply line PLAA is formed by power lines 201A, 206AA, and circuit breaker 210A. Operating circuit 220AA is connected to power line 201A via power line 207AA, and operates electrical contact 212A of circuit breaker 210A.

[0079] Power line 206BB is connected between circuit breaker 210B and control circuit 230B. Power line PLBB is formed by power lines 201B, 206BB and circuit breaker 210B. Operating circuit 220BB is connected to power line 201B via power line 207BB and operates electrical contact 212B of circuit breaker 210B.

[0080] In response to receiving the software error information IA1 from the control circuit 230A, the control circuit 230B executes the opening and closing control of the circuit breaker 210A. This opening and closing control corresponds to controlling the operation circuit 220AA to open the circuit breaker 210A (specifically, the electrical contact 212A) and then close it. Specifically, this opening and closing control corresponds to a process of transmitting an opening command SAA1 to the operation circuit 220AA and, after a predetermined time has elapsed, transmitting a closing command SAA2 to the operation circuit 220AA. The opening command SAA1 is a signal instructing the operation circuit 220AA to open the circuit breaker 210A. The closing command SAA2 is a signal instructing the operation circuit 220AA to close the circuit breaker 210A.

[0081] In the second modification, even after the circuit breaker 210A is opened, power continues to be supplied from the power source PS to the operating circuit 220AA through the power lines 201A and 207AA. As a result, the operating circuit 220AA can automatically close the circuit breaker 210A in accordance with the closing command SAA2 from the control circuit 230B. Therefore, as in the embodiment and its first modification, a software error can be automatically resolved.

[0082] Similarly, the control circuit 230A may control the operating circuit 220BB to open and then close the breaker 210B in response to receiving the software error information IB1 from the control circuit 230B.

[0083] In the second modification, each of the electrical contacts 212A and 212B of the circuit breakers 210A and 210B forms an example of the "electrical contact" of the present disclosure.

[0084] [Other variations] In the embodiment and its modifications 1 and 2, the object controlled by the control system 20 as a multiplexed control system is the power conversion device 10 (specifically, the switching element 105). However, such an object is not limited to the power conversion device 10. In other words, the multiplexed control system according to the embodiment and its modifications can also be applied to systems other than the power conversion system 1.

[0085] The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0086] 1 Power conversion system, 10 Power conversion device, 20, 50, 60 Control system, 230A, 230B Control circuit, 202A, 202AA, 202B, 202BB Control device, 205 Display device, 210A, 210B Circuit breaker, 212A, 212B, 217A, 217B Electrical contact, 215A, 215B Switch, 220A, 220AA, 220B, 220BB Operating circuit.

Claims

1. A multi-system control system including a first control device and a second control device each capable of controlling an object, wherein the first control device has an electrical contact provided on a power line, an operation circuit for operating the electrical contact, and a first memory for storing software, and includes a first control circuit that selectively takes either a first state or a second state upon receiving power supplied through the power line when the electrical contact is in a closed state, wherein the first state is a state of controlling the object, and the second state is a standby state without controlling the object, wherein the second control device includes a second control circuit that takes either the first state or the second state complementarily to the first control circuit, wherein when the first control circuit detects an abnormality, the first control circuit transmits abnormality information indicating the type of the abnormality to the second control circuit, and the abnormality information includes first information indicating that the abnormality is an error in the software, and the second control circuit executes opening / closing control for controlling the operation circuit to open and then close the electrical contact in response to receiving the first information from the first control circuit. A multi-system control system.

2. The first control device further includes a circuit breaker provided upstream of the electrical contact on the power line, and a power line connected between the circuit breaker and the electrical contact, wherein the operation circuit is connected to the power line and operates upon receiving power supplied through the power line when the circuit breaker is in a closed state. The multi-system control system according to claim 1.

3. After detecting the error, the first control device is in the second state and the second control device is in the first state, wherein the second control device includes a second memory for storing the number of executions of the opening / closing control executed within a period from a predetermined time before the current time to the current time, and in response to receiving the first information, the second control device reads out the number of executions of the opening / closing control from the second memory, and when the read number is less than a threshold value, executes the opening / closing control, and when the read number has reached the threshold value, continues the first state without executing the opening / closing control. The multi-system control system according to claim 1.

4. The multi-system control system further includes a notification device for notifying an abnormality of the first control circuit, wherein the abnormality information includes second information indicating that the abnormality is different from the error.

2. The multiplexed control system according to claim 1, wherein the notification device notifies of an abnormality in the first control circuit in response to reception of the second information by the second control circuit from the first control circuit.

5. a power conversion device as the target; A power conversion system comprising the multiple control system according to any one of claims 1 to 4.

Images