Power System

Abstract

To provide an electric power system capable of suppressing unintentional stopping even when a programmable logic device is used in a controller.SOLUTION: An electric power system comprises: a main circuit unit that performs a predetermined operation related to electric power supply; and a controller that controls an operation of the main circuit unit. The controller has: a programmable logic device having a logic circuit unit capable of changing a circuit configuration on the basis of circuit configuration information, and a software error detection unit for detecting an occurrence of software error in an entire circuit configured in the logic circuit unit; and a detection circuit for detecting a software error occurred in an important area of a circuit configured in the logic circuit unit. When the detection circuit detects a software error in the important area, the electric power system performs control to stop an operation of the main circuit unit. When only the software error detection unit detects a software error, the electric power system performs control to continue operation of the main circuit unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] FIELD OF THE INVENTION An embodiment of the present invention relates to a power system. [Background technology]

[0002] There are relatively large-scale power systems used in social infrastructure such as power grids and railways, as well as in factory facilities, etc. The power system includes a main circuit unit that performs predetermined operations related to the supply of power, such as switching the power path and converting the power, and a control device that controls the operation of the main circuit unit.

[0003] Programmable logic devices such as FPGAs (Field Programmable Gate Arrays) are now being used in the control devices of such power systems. When programmable logic devices are used, the circuit configuration can be changed as desired by changing the program, making it easier to change specifications than when using dedicated ICs such as ASICs. This can, for example, reduce the development costs of power systems.

[0004] On the other hand, in control devices that use programmable logic devices, unintended changes in the internal state of the programmable logic device due to the effects of cosmic rays or other factors can cause soft errors in the programmable logic device. The occurrence of soft errors in programmable logic devices can cause malfunctions in the control device and lead to serious failures in the power system. For this reason, power systems that use programmable logic devices as control devices detect soft errors in the programmable logic devices and shut down the power system in response to the detection of a soft error.

[0005] However, in relatively large-scale power systems such as those used in social infrastructure and factory facilities, power system outages have a significant impact on the surrounding area, so there is a demand for relatively large-scale power systems to be able to minimize unintended power system outages. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent Publication No. 2021-19394 Summary of the Invention [Problem to be solved by the invention]

[0007] The embodiment provides a power system that can suppress unintended shutdowns even when a programmable logic device is used in the control device. [Means for solving the problem]

[0008] According to an embodiment, there is provided a power system comprising: a main circuit section that performs predetermined operations related to the supply of power; and a control device that controls the operation of the main circuit section, wherein the control device has: a logic circuit section that can change its circuit configuration based on circuit configuration information; and a soft error detection section that detects the occurrence of soft errors in the entire circuit configured in the logic circuit section; a programmable logic device that performs predetermined processing related to the control of the operation of the main circuit section using the circuit configured in the logic circuit section; and a detection circuit that detects soft errors that occur in critical locations of the circuit configured in the logic circuit section, wherein when the detection circuit detects a soft error in the critical location, the power system controls to stop the operation of the main circuit section; and when the detection circuit does not detect a soft error in the critical location but only the soft error detection section detects the soft error, the power system controls to continue the operation of the main circuit section. [Effects of the Invention]

[0009] In this embodiment, an electric power system is provided that can prevent unintended shutdowns even when a programmable logic device is used as the control device. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a block diagram schematically illustrating a power system according to an embodiment. [Figure 2] FIG. 2 is a block diagram schematically illustrating an example of a control device according to the embodiment. [Figure 3] FIG. 2 is a block diagram schematically illustrating an example of a detection circuit according to the embodiment. [Figure 4] FIG. 10 is a block diagram schematically illustrating a modified example of the power system according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The drawings are schematic or conceptual, and the relationship between the thickness and width of each part, the size ratio between parts, etc. are not necessarily the same as those in reality. Furthermore, even when the same part is shown, the dimensions and ratios may be different depending on the drawing. In the present specification and the drawings, elements similar to those previously described with reference to the previous drawings are designated by the same reference numerals, and detailed descriptions thereof will be omitted as appropriate.

[0012] FIG. 1 is a block diagram schematically illustrating a power system according to an embodiment. 1, the power system 10 includes a main circuit unit 12 and a control device 14. The power system 10 is a relatively large-scale system used in social infrastructure such as power systems and railways, and in factory facilities.

[0013] The main circuit unit 12 performs predetermined operations related to the supply of power, such as switching between supplying and cutting off power, switching the path for supplying power, and converting input power into another power and supplying it to a load or the like.

[0014] The main circuit unit 12 is connected to the power line 2, for example, to perform operations such as path switching and power conversion. The voltage of the power line 2 is, for example, a high voltage or higher. More specifically, a high voltage is a DC voltage of 750 V or higher, or an AC voltage of 600 V (effective value) or higher. A relatively large-scale system is, for example, a system that handles a high voltage or higher.

[0015] The main circuit unit 12 is, for example, a changeover switch that switches between multiple power systems. The power system 10 is, for example, a system changeover system that automatically switches to another system when an abnormality occurs in one system in a substation, factory equipment, etc. The power system 10 may also be, for example, a system of a changeover section that switches power between two substations in a railway power feeder.

[0016] The main circuit unit 12 may be, for example, a conversion circuit that converts power. The power system 10 may be, for example, a power conversion system that converts supplied power into another power and outputs it. The power conversion may be any conversion, such as conversion from AC to DC, conversion from DC to AC, conversion from AC to another AC, or conversion from DC to another DC.

[0017] 1 schematically shows a configuration in which the main circuit unit 12 is provided on the path of the power lines 2. In other words, in FIG. 1, the main circuit unit 12 is provided between a pair of power lines 2. For example, if the main circuit unit 12 is a conversion circuit, the power of one of the pair of power lines 2 may be different from the power of the other of the pair of power lines 2.

[0018] However, the manner in which the main circuit unit 12 is connected to the power line 2 is not limited to the above. The manner in which the main circuit unit 12 is connected to the power line 2 may be any manner. For example, the main circuit unit 12 may be connected in parallel to the power line 2. The power system 10 may be, for example, a reactive power compensator system in which the main circuit unit 12 is connected in parallel to the power line 2 and outputs reactive power to the power line 2, thereby stabilizing the voltage of the power line 2. The operation of the main circuit unit 12 is not limited to the above and may be any operation related to the supply of power. The configuration of the main circuit unit 12 may be any configuration that performs a predetermined operation related to the supply of power.

[0019] The control device 14 controls the operation of the main circuit section 12. For example, the control device 14 controls operations such as switching of power paths and power conversion by the main circuit section 12. For example, the control device 14 communicates with the higher-level device 4 and controls the operation of the main circuit section 12 based on commands from the higher-level device 4. However, the control device 14 does not necessarily have to communicate with the higher-level device 4. The control device 14 may also independently control the operation of the main circuit section 12 without receiving commands from the outside.

[0020] FIG. 2 is a block diagram schematically illustrating an example of a control device according to the embodiment. 2, the control device 14 includes an FPGA 20 (programmable logic device), a PLD 22, a CPU 24, a DSP 26, a storage unit 28, a CPU ADC 30 (conversion circuit), a CPU DAC 32, a DSP ADC 34 (conversion circuit), a DSP DAC 36, and a notification unit 38. Note that only a portion of the control device 14 is illustrated in FIG. 2 for convenience. Also, some wiring and the like are omitted from the illustration in FIG. 2 for convenience.

[0021] The FPGA (Field-Programmable Gate Array) 20, the PLD (Programmable Logic Device) 22, the CPU (Central Processing Unit) 24, and the DSP (Digital Signal Processor) 26 perform predetermined processing related to the control of the operation of the main circuit unit 12. The processing performed by each of these units may be any processing related to the control of the operation of the main circuit unit 12.

[0022] The FPGA 20 includes a logic circuit unit 40, a soft error detection unit 42, and a heartbeat signal generation unit 44. The logic circuit unit 40 is a component of a logic circuit whose circuit configuration can be changed based on circuit configuration information BSD. The FPGA 20 performs predetermined processing related to controlling the operation of the main circuit unit 12 using the circuit configured in the logic circuit unit 40.

[0023] The logic circuit unit 40 is configured by a plurality of logic blocks having, for example, a lookup table, a multiplexer, a register, etc. The logic circuit unit 40 can change the circuit configuration by, for example, changing the configuration of the lookup table based on the circuit configuration information BSD.

[0024] The logic circuit unit 40 is configured, for example, by a volatile memory. The logic circuit unit 40 is configured, for example, by an SRAM (Static Random Access Memory). The FPGA 20 is, for example, an SRAM-based FPGA. The logic circuit unit 40 is, for example, a Configuration RAM (CRAM).

[0025] The storage unit 28 is a non-volatile storage unit that stores the circuit configuration information BSD. For example, a flash memory or an EEPROM is used for the storage unit 28. The storage unit 28 is connected to the FPGA 20. The storage unit 28 is an external non-volatile memory for the FPGA 20. The FPGA 20 configures a circuit in the logic circuit unit 40 by reading the circuit configuration information BSD from the storage unit 28 every time the power is turned on. Note that the storage unit 28 is not limited to being provided outside the FPGA 20, and may be provided inside the FPGA 20.

[0026] The soft error detection unit 42 detects the occurrence of soft errors throughout the entire circuit configured in the logic circuit unit 40. A soft error is an abnormality in the circuit configured in the logic circuit unit 40 caused by unintended bit inversion due to the influence of cosmic rays or the like. The soft error detection unit 42 detects soft errors in the circuit configured in the logic circuit unit 40 using, for example, a CRC (Cyclic Redundancy Check).

[0027] The heartbeat signal generation unit 44 generates a heartbeat signal that indicates that the FPGA 20 is operating normally, and outputs the generated heartbeat signal. The heartbeat signal generation unit 44 outputs the heartbeat signal, for example, periodically. The heartbeat signal generation unit 44 generates the heartbeat signal based on a signal input from the logic circuit unit 40, for example. In other words, the heartbeat signal is a signal that indicates that the logic circuit unit 40 is operating normally.

[0028] In this example, the soft error detection unit 42 and the heartbeat signal generation unit 44 are provided separately from the logic circuit unit 40. However, without being limited to this, the soft error detection unit 42 and the heartbeat signal generation unit 44 may be provided within the logic circuit unit 40. In other words, the soft error detection unit 42 and the heartbeat signal generation unit 44 may be configured in the logic circuit unit 40 based on the circuit configuration information BSD.

[0029] The logic circuit unit 40 includes, for example, an internal register 50, an inter-CPU I / F unit 51, an inter-DSP I / F unit 52, a DI / DO I / F unit 53, a CPU ADC control unit 54 (control unit), a CPU DAC control unit 55, a DSP ADC control unit 56 (control unit), a DSP DAC control unit 57, a LAN I / F unit 58, and a logger function unit 59. Each of these units is configured in the logic circuit unit 40 based on the circuit configuration information BSD.

[0030] The internal register 50 is a storage device that temporarily stores data used in calculations within the logic circuit unit 40. The inter-CPU I / F unit 51 is connected to the CPU 24 and transmits and receives signals to and from the CPU 24. The inter-DSP I / F unit 52 is connected to the DSP 26 and transmits and receives signals to and from the DSP 26. The DI / DO I / F unit 53 is used for inputting and outputting digital signals to and from external devices such as the PLD 22. The CPU ADC control unit 54 is connected to the CPU ADC 30 and controls the CPU ADC 30. The CPU DAC control unit 55 is connected to the CPU DAC 32 and controls the CPU ADC 30. The DSP ADC control unit 56 is connected to the DSP ADC 34 and controls the DSP ADC 34. The DSP DAC control unit 57 is connected to the DSP DAC 36 and controls the DSP DAC 36. The LAN I / F unit 58 is connected to a LAN (Local Area Network) and transmits and receives signals to and from the LAN. The logger function unit 59 stores the data input to the logic circuit unit 40. The circuits configured in the logic circuit unit 40 are not limited to those described above, and may be any circuits for performing predetermined processing related to controlling the operation of the main circuit unit 12.

[0031] The CPU ADC (Analog to Digital Converter) 30 receives an input analog signal and converts the input analog signal into a digital signal. The CPU ADC 30 receives an input analog signal, for example, from the main circuit unit 12. The CPU ADC 30 receives an input analog signal, for example, from a sensor or the like provided in the main circuit unit 12. The CPU ADC 30 converts the analog signal into a digital signal based on the control of the CPU ADC control unit 54 of the FPGA 20. The CPU ADC 30 inputs the converted digital signal to the CPU 24.

[0032] The CPU DAC (Digital-to-Analog Converter) 32 receives a digital signal input from the CPU 24 and converts the input digital signal into an analog signal. The CPU 24 performs predetermined processing related to control of the operation of the main circuit unit 12, for example, based on the digital signal input from the CPU ADC 30.

[0033] The DSP ADC 34 receives an input analog signal and converts it into a digital signal, similar to the CPU ADC 30. The DSP DAC 36 receives an input digital signal and converts it into an analog signal, similar to the CPU DAC 32. The DSP 26, similar to the CPU 24, performs predetermined processing related to the control of the operation of the main circuit unit 12, for example, based on the digital signal input from the DSP ADC 34.

[0034] The control device 14 further includes a detection circuit 60. The detection circuit 60 detects soft errors that occur in critical parts of the circuit configured in the logic circuit unit 40. The detection circuit 60 detects only soft errors that occur in critical parts of the circuit configured in the logic circuit unit 40. The detection circuit 60 is provided in, for example, the CPU 24. The CPU 24 has a higher resistance to soft errors than the FPGA 20. In this way, the detection circuit 60 is provided in, for example, a semiconductor element that has a higher resistance to soft errors than the FPGA 20.

[0035] The PLD 22 has a soft error detection on-delay 70, a heartbeat abnormality detection circuit 72, and OR circuits 74 and 76. When the soft error detection unit 42 detects the occurrence of a soft error in a circuit configured in the logic circuit unit 40, the soft error detection on-delay 70 delays the detection of the soft error by the soft error detection unit 42 by a predetermined time and inputs the detection result to the OR circuit 74. Like the CPU 24, the PLD 22 is a semiconductor element that has higher resistance to soft errors than the FPGA 20.

[0036] The heartbeat abnormality detection circuit 72 detects abnormalities in the heartbeat signal input from the heartbeat signal generation unit 44. For example, if a heartbeat signal is not periodically input from the heartbeat signal generation unit 44 (if a heartbeat signal is not input for a predetermined time or longer), the heartbeat abnormality detection circuit 72 detects an abnormality in the heartbeat signal and inputs an abnormality detection signal to the OR circuit 74.

[0037] The OR circuit 74 is connected to the alarm unit 38. When the soft error detection on-delay 70 inputs a detection signal of the occurrence of a soft error, or when the heartbeat signal abnormality detection circuit 72 inputs a signal of the detection of an abnormality in the heartbeat signal, the OR circuit 74 instructs the alarm unit 38 to issue an alarm.

[0038] The notification unit 38 notifies the occurrence of a soft error in the logic circuit unit 40 or the occurrence of an abnormality in the heartbeat signal in response to an instruction to execute notification from the OR circuit 74. In this way, the control device 14 has the notification unit 38 for notifying the occurrence of a soft error, and controls the notification unit 38 to notify the occurrence of a soft error when the soft error detection unit 42 detects a soft error.

[0039] The notification unit 38 is, for example, a lamp that issues a notification by turning on a light. The notification unit 38 may also be, for example, a display device that issues a notification by displaying characters or patterns, or a speaker that issues a notification by outputting sound. The notification unit 38 may be configured in any way that can appropriately notify the manager of the power system 10 or the like of the occurrence of an abnormality.

[0040] In this example, the outputs of the soft error detection on-delay 70 and the heartbeat anomaly detection circuit 72 are input to an OR circuit 74, and when at least one of the soft error detection on-delay 70 and the heartbeat anomaly detection circuit 72 detects an anomaly, the annunciation unit 38 issues an annunciation. Without being limited to this, for example, the outputs of the soft error detection on-delay 70 and the heartbeat anomaly detection circuit 72 may be input to the annunciation unit 38 so that the annunciation unit 38 can individually notify the detection of the occurrence of a soft error and the detection of an anomaly in the heartbeat signal. The annunciation unit 38 only needs to be configured to be able to notify at least the occurrence of a soft error.

[0041] The OR circuit 76 receives a detection signal of a soft error in a critical location detected by the detection circuit 60, as well as other control abnormality signals detected by the CPU 24, DSP 26, etc. The OR circuit 76 outputs a major failure signal in response to the input of the detection signal from the detection circuit 60 or the input of other control abnormality signals. The OR circuit 76 outputs the major failure signal to the higher-level device 4, for example.

[0042] In response to the input of the serious failure signal from the control device 14, the higher-level device 4 instructs the control device 14 to stop the operation of the main circuit unit 12. In response to the instruction from the higher-level device 4, the control device 14 stops the operation of the main circuit unit 12.

[0043] In this way, when the detection circuit 60 detects a soft error in a critical location, the control device 14 performs control to stop the operation of the main circuit unit 12, and when the detection circuit 60 does not detect a soft error in a critical location and only the soft error detection unit 42 detects a soft error, the control device 14 performs control to continue the operation of the main circuit unit 12. When the detection circuit 60 does not detect a soft error in a critical location and only the soft error detection unit 42 detects a soft error, the control device 14, for example, does not stop the operation of the main circuit unit 12 and only notifies the notification unit 38 of the occurrence of a soft error.

[0044] In addition, the control performed by the detection circuit 60 to stop the operation of the main circuit unit 12 when it detects a soft error in a critical location is not limited to the control of outputting a major fault signal to the upper device 4 and stopping the operation of the main circuit unit 12 in response to an instruction from the upper device 4, but may also be control of immediately stopping the operation of the main circuit unit 12 in response to the detection of a soft error in a critical location by the detection circuit 60.

[0045] The detection circuit 60 detects soft errors that occur in the CPU ADC control unit 54 and the DSP ADC control unit 56, for example, with the CPU ADC control unit 54 and the DSP ADC control unit 56 being considered as important parts.

[0046] FIG. 3 is a block diagram schematically illustrating an example of a detection circuit according to the embodiment. As shown in FIG. 3, the detection circuit 60 includes, for example, change detection circuits 80 and 81, detection time limit circuits 82 and 83, an OR circuit 84, and an AND circuit 85.

[0047] The detection circuit 60 receives as input the value of the AD conversion result after the CPU ADC 30 converts the analog signal into a digital signal. The detection circuit 60 also receives as input the value of the AD conversion result after the DSP ADC 34 converts the analog signal into a digital signal. The AD conversion result of the DSP ADC 34 is input from the DSP ADC 34 to the CPU 24 (detection circuit 60). The AD conversion result of the DSP ADC 34 may also be input to the CPU 24 from the DSP 26, for example.

[0048] The change detection circuit 80 receives the AD conversion result from the CPU ADC 30, and if the value of the input AD conversion result has not changed, it inputs a no-change signal to a detection time-limit circuit 82. If the state in which the value of the AD conversion result has not changed continues for a predetermined time or longer, the detection time-limit circuit 82 inputs the no-change signal to an OR circuit 84.

[0049] The change detection circuit 81 receives the AD conversion result from the DSP ADC 34, and if the value of the input AD conversion result has not changed, it inputs a no-change signal to the detection time limit circuit 83. If the state in which the value of the AD conversion result has not changed continues for a predetermined time or longer, the detection time limit circuit 83 inputs the no-change signal to the OR circuit 84.

[0050] When a no-change signal is input from at least one of the detection time limit circuits 82 and 83, the OR circuit 84 inputs the no-change signal to the AND circuit 85.

[0051] The AND circuit 85 receives as input the no-change signal from the OR circuit 84 and the soft error detection signal from the soft error detection unit 42. When the AND circuit 85 receives as input the no-change signal from the OR circuit 84 and the soft error detection signal from the soft error detection unit 42, it outputs a soft error detection signal for important locations (the CPU ADC control unit 54 and the DSP ADC control unit 56).

[0052] When the CPU ADC control unit 54 and the DSP ADC control unit 56 are operating normally, the AD conversion results of the CPU ADC 30 and the DSP ADC 34 each change in value over time due to the influence of noise, etc., even when a normal analog detection signal is input or when no input is present. For this reason, if the value of the AD conversion result does not change for a predetermined time or longer, it is considered that some abnormality has occurred in the CPU ADC control unit 54 and the DSP ADC control unit 56.

[0053] Therefore, as described above, when the value of the AD conversion result does not change for a predetermined time or more, the detection circuit 60 determines that a soft error has occurred in a critical location and outputs a detection signal for a soft error in a critical location. For example, when the value of the AD conversion result does not change for a predetermined time or more and a soft error has been detected by the soft error detection unit 42, the detection circuit 60 outputs a detection signal for a soft error in a critical location. This makes it possible to more appropriately detect the occurrence of a soft error in a critical location.

[0054] As described above, in the power system 10 according to this embodiment, the control device 14 performs control to stop operation of the main circuit unit 12 when the detection circuit 60 detects a soft error in a critical location, and performs control to continue operation of the main circuit unit 12 when the detection circuit 60 does not detect a soft error in a critical location and only the soft error detection unit 42 detects a soft error. This makes it possible to prevent unintended shutdown of the power system 10 (main circuit unit 12) due to the detection of a soft error, compared to, for example, a case in which operation of the main circuit unit 12 is stopped in response to the detection of a soft error by the soft error detection unit 42. Therefore, even when an FPGA 20 (programmable logic device) is used for the control device 14, unintended shutdown of the power system 10 can be prevented.

[0055] In the power system 10, the control device 14 further includes a notification unit 38 for notifying the occurrence of a soft error, and controls the notification unit 38 to notify the occurrence of a soft error when the soft error detection unit 42 detects a soft error. This makes it possible to notify, for example, a manager of the power system 10, that a soft error has occurred in a part other than a critical part. For example, the manager of the power system 10 can be prompted to take action to resolve the soft error. An example of the action to resolve the soft error is to shut off the power supply to the control device 14 and restart the control device 14 when the operation of the power system 10 can be stopped. A soft error that has occurred in the logic circuit unit 40 can be resolved by restarting the control device 14 and re-reading the circuit configuration information BSD.

[0056] In the power system 10, the control device 14 further includes a non-volatile memory unit 28 that stores the circuit configuration information BSD, and the FPGA 20 configures a circuit in the logic circuit unit 40 by reading the circuit configuration information BSD from the memory unit 28 each time the power is turned on. Even if the logic circuit unit 40 is configured using a volatile memory that has a relatively low resistance to soft errors, as described above, when the detection circuit 60 detects a soft error in a critical location, the operation of the main circuit unit 12 is stopped, thereby appropriately preventing the power system 10 from being unintentionally stopped.

[0057] In this example, an FPGA 20 is shown as an example of a programmable logic device. The programmable logic device is not limited to the FPGA 20, but may be any device having a logic circuit unit 40 whose circuit configuration can be changed based on the circuit configuration information BSD, and a soft error detection unit 42 that detects the occurrence of soft errors in the entire circuit configured in the logic circuit unit 40.

[0058] In the power system 10, the detection circuit 60 designates the CPU ADC control unit 54 and the DSP ADC control unit 56 as critical parts and detects soft errors that occur in the CPU ADC control unit 54 and the DSP ADC control unit 56. The CPU ADC control unit 54 and the DSP ADC control unit 56 handle analog signals, making them more difficult to superimpose than parts that handle digital signals, and it is also more difficult to detect abnormalities in other parts. For this reason, designating the CPU ADC control unit 54 and the DSP ADC control unit 56 as critical parts makes it possible to appropriately prevent malfunctions of the control device 14. For example, even if the main circuit unit 12 continues to operate even if a soft error occurs in a part other than the critical parts, it is possible to appropriately prevent serious failures in the power system 10.

[0059] However, the critical parts of the logic circuit unit 40 are not limited to the CPU ADC control unit 54 and the DSP ADC control unit 56. For example, the internal register 50, the CPU I / F unit 51, the DSP I / F unit 52, the DI / DO I / F unit 53, etc. may be set as critical parts. The critical part of the logic circuit unit 40 may be, for example, any circuit that may lead to a serious failure of the power system 10.

[0060] In the power system 10, the detection circuit 60 detects that a soft error has occurred in the CPU ADC control unit 54 and the DSP ADC control unit 56 when the value of the AD conversion result does not change for a predetermined time or longer. This makes it possible to properly detect soft errors that have occurred in the CPU ADC control unit 54 and the DSP ADC control unit 56. Note that the method for detecting soft errors in important locations is not limited to the above, and any method corresponding to the configuration of the important locations may be used. The detection circuit 60 may be configured, for example, to individually detect soft errors in important locations using CRC.

[0061] FIG. 4 is a block diagram schematically illustrating a modified example of the power system according to the embodiment. 4, the power system 10a includes a plurality of main circuit units 12 and a plurality of control devices 14. Components that are substantially the same in function and configuration as those in the above embodiment are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0062] 4 schematically shows a configuration in which a plurality of main circuit units 12 are connected in series on the path of the power line 2. The configuration of the plurality of main circuit units 12 is not limited to the above. For example, the plurality of main circuit units 12 may be configured so that they are connected in parallel to the power line 2. The configuration of the plurality of main circuit units 12 may be any configuration in which each of the plurality of main circuit units 12 performs a predetermined operation related to the supply of power.

[0063] The multiple control devices 14 control the operation of each of the multiple main circuit units 12. The number of the multiple control devices 14 is, for example, the same as the number of the multiple main circuit units 12. However, the number of the multiple control devices 14 does not necessarily have to be the same as the number of the multiple main circuit units 12. For example, one control device 14 may control the operation of multiple main circuit units 12.

[0064] When the detection circuit 60 detects a soft error in a critical location, each of the plurality of control devices 14 performs control to stop the operation of each of the plurality of main circuit units 12.

[0065] Each of the plurality of control devices 14 outputs a major failure signal to the higher-level device 4 in response to, for example, detection of a soft error in a critical location by the detection circuit 60. In response to input of a major failure signal from any of the plurality of control devices 14, the higher-level device 4 instructs each of the plurality of control devices 14 to stop operation of the plurality of main circuit units 12. In response to the instruction from the higher-level device 4, the plurality of control devices 14 stop operation of the plurality of main circuit units 12.

[0066] For example, each of the multiple control devices 14 may stop the operation of the multiple main circuit units 12 by outputting a major fault signal to the other control devices 14 in response to detection of a soft error in a critical location by the detection circuit 60. The control for stopping the operation of each of the multiple main circuit units 12 when the detection circuit 60 detects a soft error in a critical location is not limited to the above, and any control that can appropriately stop the operation of the multiple main circuit units 12 in response to detection of a soft error in a critical location in any of the multiple control devices 14 may be used.

[0067] The present embodiment includes the following aspects. (Appendix 1) a main circuit section that performs a predetermined operation related to the supply of power; a control device for controlling the operation of the main circuit unit; Equipped with The control device a programmable logic device having a logic circuit unit whose circuit configuration can be changed based on circuit configuration information, and a soft error detection unit that detects occurrence of a soft error in the entire circuit configured in the logic circuit unit, the programmable logic device performing predetermined processing related to control of the operation of the main circuit unit by the circuit configured in the logic circuit unit; a detection circuit that detects a soft error that occurs in a critical part of the circuit configured in the logic circuit unit; when the detection circuit detects a soft error in the critical location, the power system performs control to stop the operation of the main circuit unit, and when the detection circuit does not detect a soft error in the critical location and only the soft error detection unit detects the soft error, the power system performs control to continue the operation of the main circuit unit.

[0068] (Appendix 2) 2. The power system according to claim 1, wherein the control device further includes an alarm unit for notifying the occurrence of the soft error, and when the soft error detection unit detects the soft error, controls the alarm unit to notify the occurrence of the soft error.

[0069] (Appendix 3) the control device further includes a nonvolatile storage unit that stores the circuit configuration information; 3. The power system according to claim 1, wherein the programmable logic device configures the circuit in the logic circuit unit by reading the circuit configuration information from the memory unit each time the power is turned on.

[0070] (Appendix 4) the control device has a conversion circuit that converts an analog signal into a digital signal; the circuit configured in the logic circuit unit has a control unit that controls the conversion circuit, 4. The power system according to claim 1, wherein the detection circuit detects a soft error that occurs in the control unit, with the control unit being the critical location.

[0071] (Appendix 5) 5. The power system of claim 4, wherein the detection circuit detects that a soft error has occurred in the control unit when the value of the conversion result after conversion from the analog signal to the digital signal by the conversion circuit does not change for a predetermined period of time or more.

[0072] (Appendix 6) A plurality of the main circuit units; a plurality of the control devices that control the operation of each of the plurality of main circuit units; Equipped with The power system according to any one of appendices 1 to 5, wherein each of the plurality of control devices performs control to stop the operation of each of the plurality of main circuit units when the detection circuit detects a soft error in the critical location.

[0073] Although several embodiments of the present invention have been described above, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, as well as within the scope of the invention and its equivalents as set forth in the claims. Furthermore, the above-described embodiments can be implemented in combination with each other. [Explanation of symbols]

[0074] 2...power line, 4...host device, 10, 10a...power system, 12...main circuit section, 14...control device, 20...FPGA (programmable logic device), 22...PLD, 24...CPU, 26...DSP, 28...storage section, 30...CPU ADC (conversion circuit), 32...CPU DAC, 34...DSP ADC (conversion circuit), 36...DSP DAC, 38...alarm section, 40...logic circuit section, 42...soft error detection section, 44...heartbeat signal generation section, 50...internal register, 51...inter-CPU I / F section, 52...inter-DSP I / F section, 53...DI / DO I / F section, 54...CPU ADC control section (control section), 55...CPU DAC control section, 56...DSP ADC control section (control section), 57...DSP DAC control section, 58...LAN I / F section, 59...Logger function section, 60...Detection circuit, 70...Soft error detection on-delay, 72...Heartbeat abnormality detection circuit, 74, 76...OR circuit, 80, 81...Change detection circuit, 82, 83...Detection time limit circuit, 84...OR circuit, 85...AND circuit

Claims

1. a main circuit section that performs a predetermined operation related to the supply of power; a control device for controlling the operation of the main circuit unit; Equipped with The control device a programmable logic device having a logic circuit unit whose circuit configuration can be changed based on circuit configuration information, and a soft error detection unit that detects occurrence of a soft error in the entire circuit configured in the logic circuit unit, the programmable logic device performing predetermined processing related to control of the operation of the main circuit unit by the circuit configured in the logic circuit unit; a detection circuit that detects a soft error that occurs in a critical part of the circuit configured in the logic circuit unit; when the detection circuit detects a soft error in the critical location, the power system performs control to stop the operation of the main circuit unit, and when the detection circuit does not detect a soft error in the critical location and only the soft error detection unit detects the soft error, the power system performs control to continue the operation of the main circuit unit.

2. 2. The power system according to claim 1, wherein the control device further includes a notification unit for notifying the occurrence of the soft error, and when the soft error detection unit detects the soft error, the control device controls the notification unit to notify the occurrence of the soft error.

3. the control device further includes a nonvolatile storage unit that stores the circuit configuration information; 2. The power system according to claim 1, wherein the programmable logic device configures the circuit in the logic circuit unit by reading the circuit configuration information from the storage unit each time power is turned on.

4. the control device has a conversion circuit that converts an analog signal into a digital signal; the circuit configured in the logic circuit unit has a control unit that controls the conversion circuit, The power system according to claim 1 , wherein the detection circuit detects a soft error occurring in the control unit, with the control unit being the critical location.

5. 5. The power system according to claim 4, wherein the detection circuit detects that a soft error has occurred in the control unit when the value of the conversion result after conversion from the analog signal to the digital signal by the conversion circuit does not change for a predetermined time or more.

6. A plurality of the main circuit units; a plurality of the control devices that control the operation of each of the plurality of main circuit units; Equipped with The power system according to any one of claims 1 to 5, wherein each of the plurality of control devices performs control to stop the operation of each of the plurality of main circuit units when the detection circuit detects a soft error in the critical location.

Images