Pre-protection control device, anomaly detection and recovery method, protection control system

Abstract

To reduce cost for a digital protection control system while securing reliability.SOLUTION: A preliminary protection control device is connected to a plurality of merging units and a plurality of protection control devices, and holds a plurality of protection control programs for implementing the respective functions of the plurality of protection control devices. When detecting an abnormality of any one of the protection control devices, the control device determines whether the protection control programs for implementing the functions of the protection control devices other than the protection control device in which the abnormality was detected are being executed. If the protection control programs for implementing the functions of the protection control devices other than the protection control device in which the abnormality was detected are not being executed, it starts execution of the protection control program for implementing the functions of the protection control device in which the abnormality was detected.SELECTED DRAWING: Figure 1

Description

Technical Field

[0005] , ,

[0001] The present invention relates to protection control technology for power systems, and particularly to an abnormality detection method, a system recovery method, and a switching-back method during abnormality recovery when an arithmetic device (Intelligent Electronic Device (hereinafter referred to as IED)), called a digital protection control device, which connects an upper device (Station Computer (hereinafter referred to as SC), Gateway (hereinafter referred to as GW)) and a lower device (Murging Unit (hereinafter referred to as MU)), is a single system.

Background Art

[0002] Due to technological innovations in digital devices and communication technologies, MUs are installed closer to the equipment to be monitored, and information is exchanged with the IEDs installed in the substation switchboard room via process bus transmission. Also, for the purpose of monitoring and controlling maintenance personnel, SC and GW exchange information with IEDs via station bus transmission.

[0003] One of the merits of digitization is cost reduction due to equipment slimming, which is one of the purposes of digitization. However, in order to ensure system reliability, dual-system operation is basically adopted in the system series of ultra-high voltage substations. IEDs are classified into protection relay devices for monitoring and removing system accidents and control devices for monitoring substation status and operating equipment. When these are a single system, degraded operation or system shutdown is required in case of IED abnormality.

[0004] Japanese Patent Application Laid-Open No. 2010-068594 (Patent Document 1) discloses a protection control system in which IEDs are a single system, and a spare IED and a database IED are installed. When the protection control device is abnormal, the database IED downloads the information of the failed device, and recovers as a replacement device for the abnormal IED.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

[0006] As described above, Patent Document 1 discloses a protection control system that uses a single IED system and installs a backup IED and a database IED, but it does not specify the anomaly detection method or the response after recovery. In digital substations, many MUs and IEDs are connected, making it complicated to determine the anomaly detection method. Furthermore, regarding the recovery method in the event of an anomaly, it is necessary to have a mechanism that can identify and recover the target IED using only the backup IED, and to organize the response of the backup IED when the target IED is recovered. [Means for solving the problem]

[0007] In order to solve at least one of the above problems, the present invention provides It is connected to a plurality of merging units connected to at least one of an instrument for measuring the power system and equipment for controlling the power system, and to a plurality of protection control devices that communicate with at least one of the merging units and have the function of performing calculations for the protection or control of the power system. A backup protection control device, before The auxiliary protection control device comprises a processor and a memory, the memory holding a plurality of protection control programs for realizing the functions of each of the plurality of protection control devices, and the processor, upon detecting an abnormality in any of the plurality of protection control devices, determines whether the protection control program for realizing the functions of the protection control devices other than the protection control device that detected the abnormality is being executed, and if the protection control program for realizing the functions of the protection control devices other than the protection control device that detected the abnormality is not being executed, the processor starts execution of the protection control program for realizing the functions of the protection control device that detected the abnormality. Furthermore, when a predetermined packet is received from the protection control device that detected the abnormality, it is determined whether the protection control program for realizing the function of the protection control device that detected the abnormality is being executed, and if the protection control program for realizing the function of the protection control device that detected the abnormality is being executed, its execution is terminated. It is characterized by doing so. [Effects of the Invention]

[0008] According to one aspect of the present invention, it is possible to ensure system reliability and reduce costs by using a single system without requiring two separate systems for protective IEDs and control IEDs. This enables a configuration suitable for IEDs that do not require metal cables.

[0009] Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0010] [Figure 1] This is a block diagram showing an example of the configuration of a digital substation system according to an embodiment of the present invention. [Figure 2] This is a block diagram showing the internal configuration of a spare IED according to an embodiment of the present invention. [Figure 3] This flowchart shows an example of the operation of a preliminary IED according to an embodiment of the present invention. [Modes for carrying out the invention]

[0011] The following examples will be described with reference to the drawings.

[0012] Figure 1 is a block diagram showing an example of the configuration of a digital substation system 1 according to an embodiment of the present invention.

[0013] The equipment (CB, LS) 10, such as circuit breakers (hereinafter CB) and disconnectors (hereinafter LS), and the instruments (PT, CT) 9, such as instrument transformers (PT) and instrument transformers (CT), installed within the substation are connected to MU8-1 to 8-L by metal wires. MU8-1 to 8-L digitize the status of the equipment and instruments in each section of the substation and send the data to the process bus 12. In the following explanation, MU8 may be used to refer to MU8-1 to 8-L as a whole or to each of them individually. The same applies to the protective IED5-1 to 5-N and control IED6-1 to 6-M described later.

[0014] The protective IEDs 5-1 to 5-N detect faults within the substation using protective relay calculations based on analog data obtained from instrument 9. If a fault is detected, they send a shutdown command for the target equipment to the MU via the process bus 12. The MU8 then shuts off the target CB via metal wires to suppress the spread of the fault.

[0015] The control IEDs 6-1 to 6-M convert analog data obtained from instrument 9 into the instrument's primary value and send it to the station bus 11 transmission. The control IEDs also send equipment status to the station bus transmission. The control IED 6 receives equipment control commands from the gateway (GW) 5 and direct operation PC (SC) 4 via the station bus transmission and sends control commands to the MU 8 connected to the target equipment via process bus transmission. The MU 8 then shuts off or turns on the target equipment via metal wire according to the command.

[0016] SC4 is a monitoring and control device for direct control when the GW is not in use. When the GW is not in use, control is transferred from GW3 to SC4, enabling monitoring of measured values ​​and equipment status within the substation from the control IED6 received via station bus transmission. It also enables equipment operation for system shutdown due to equipment inspection, etc. GW3 is used for remote control and remote monitoring from the control station system 2 outside the substation, and its implemented functions are equivalent to those of SC4.

[0017] During normal operation, the backup IED7 does not perform monitoring, control, or protective relay-related actions for this digital substation system 1. Instead, it monitors the transmission status between the protective IED5 and control IED and MU8, and can switch to a replacement IED if any of the IEDs malfunction. Furthermore, once the cause of the malfunction in the malfunctioning IED is resolved, the backup IED7 has finished its role as a replacement for the malfunctioning IED and can be switched back to its original state.

[0018] Figure 2 is a block diagram showing the internal configuration of a preliminary IED7 according to an embodiment of the present invention.

[0019] The standby IED7 has a CPU21, a ROM23, and a RAM24, which are connected via an internal bus 22. In the ROM23 inside the standby IED7, all programs of the protection program (for memory) 26 of the protection IED5 shown in FIG. 1, the control program (for memory) 27 of the control IED6, and the standby IED program (for memory) 25 of the standby IED7 are compressed and stored.

[0020] In the example of FIG. 2, as the protection program (for memory) 26, the protection IED1 program to the protection IEDN program are stored. These are each programs obtained by compressing programs for operating the standby IED7 as an alternative IED for the protection IED5-1 to the protection IED5-N. For example, they are programs obtained by compressing programs equivalent to those operating in the protection IED5-1 to the protection IED5-N, respectively.

[0021] Similarly, in the example of FIG. 2, as the control program (for memory) 27, the control IED1 program to the control IEDM program are stored. These are each programs obtained by compressing programs for operating the standby IED7 as an alternative IED for the control IED6-1 to the control IED6-M. For example, they are programs obtained by compressing programs equivalent to those operating in the control IED6-1 to the control IED6-M, respectively.

[0022] When the system is normal, the decompressed standby IED program (operation) 28 is stored in the RAM24 and is operated in a state loaded in the CPU21. The standby IED program 28 is a simple program that does not affect the system.

[0023] Also, in the RAM24, an abnormality / recovery detection program 30 is stored so that the standby IED7 can monitor the transmission state between each of the protection IED5 and the control IED6 and the MU8, and is loaded in the CPU21.

[0024] For example, if the protective IED5-1 malfunctions, the CPU21 issues a command to the RAM24 to decompress the protective IED1 program (for memory) 26 stored in the ROM23 and overwrite it in the write area of ​​the backup IED program 28 in the RAM24. After confirming that the protective IED1 program (operation) 29, which was decompressed from the protective IED1 program (for memory) 26, has overwritten the RAM24, the CPU21 loads the protective IED1 program 29 and then refreshes it.

[0025] Figure 3 is a flowchart showing an example of the operation of a preliminary IED7 according to an embodiment of the present invention.

[0026] Figure 3 illustrates, as a specific example, the recovery response in the event of a malfunction in the protective IED1 by the abnormality / recovery detection program 30 implemented in the backup IED7. The backup IED7 is always aware of the transmission status between each protective IED5 and each control IED6 and each MU8 (step 31). For example, each MU8 may transmit information to the backup IED7 via process bus transmission indicating which protective IED5 or control IED6 each MU8 is transmitting and receiving with, and the backup IED7 may recognize the transmitting and receiving partner of each IED based on this information.

[0027] Next, the backup IED7 determines whether the protective IED5-1 is connected to more than two devices (step 32). If the protective IED5-1 is connected to two devices, it determines whether both of those devices are malfunctioning (step 34). The purpose of this is that if there are two devices that transmit and receive the IED, malfunction information from only one of them is insufficient to determine that the IED is malfunctioning. Therefore, the backup IED7 determines that the protective IED5-1 is malfunctioning only when malfunction information is received from both devices. The reason for the AND condition of two devices is to prevent the backup IED7 from mistakenly determining that the protective IED5-1 is malfunctioning if the MU side connected to the protective IED5-1 experiences a CPU failure or malfunction.

[0028] Furthermore, if the number of devices to which the protective IED 5-1 is connected is greater than two, the backup IED 7 performs a majority vote and determines that the IED is faulty if the number of fault judgments is equal to or greater than the number of normal judgments (step 33). In this majority vote, if the number of fault judgments and normal judgments are the same, the number of fault judgments takes precedence and the IED is determined to be faulty.

[0029] Furthermore, the backup IED7 may monitor packets transmitted and received via, for example, the process bus 12, and detect transmission anomalies with an IED if there is an IED that does not respond to packets from MU8. For example, if in step 31 it is recognized that the sending and receiving partner of MU8-1 is the protective IED5-1, and packets are sent from MU8-1 to the protective IED5-1, but packets are not sent from the protective IED5-1 to MU8-1, the backup IED7 may detect transmission anomalies between MU8-1 and the protective IED5-1. Alternatively, in such a case, MU8-1 may notify the backup IED7 of the transmission anomaly with the protective IED5-1, and based on that, the backup IED7 may detect transmission anomalies between MU8-1 and the protective IED5-1.

[0030] Under the conditions of the example shown in Figure 3, the protective IED 5-1 transmits and receives data from two devices, MU8-1 and MU8-2. In this case, when the backup IED 7 receives abnormal information from both of these devices, it determines that the protective IED 1 is abnormal and checks whether the current program of the backup IED 7 is the backup IED program 28 (step 35). The purpose of this is that if another program is already loaded, the program rewriting process cannot be performed, and in this case, the process is terminated (step 37).

[0031] If there is only one spare IED7 included in the digital substation system 1, only one IED will be available for replacement. However, as an enhanced function, if multiple spare IED7s are provided and in operation, a priority order can be set for the spare IED7s, allowing them to replace IEDs that are determined to be malfunctioning, starting with the spare IED7 with the lowest priority.

[0032] In step 37, if it is confirmed that the currently loaded program is the backup IED program 28, the backup IED 7 decompresses the protective IED 1 program 26 recorded in ROM 23, rewrites the decompressed protective IED 1 program 29 to RAM 24, loads it to CPU 21 after the rewriting is complete, and performs a CPU refresh after the loading is complete (step 36).

[0033] After the refresh, if CPU21 runs normally, the backup IED7 connects to MU8 on the process bus transmission side and to SC4 and GW3 on the station bus transmission side, thereby allowing the backup IED7 to replace the protective IED5-1 and restore the digital substation system 1.

[0034] In the case of a malfunctioning protective IED 5-1, after a period of time, maintenance personnel will go to the substation and restore the IED by replacing the circuit board that was the cause of the malfunction. During the restoration operation, the power to the protective IED 5-1 is temporarily cut off and then turned back on, which starts up the CPU (not shown) of the protective IED 5-1. After startup is complete, the protective IED 5-1 sends an initial packet (i.e., the first packet at the start of normal CPU processing) via program bus transmission to each MU8 and the backup IED 7. The backup IED 7 receives this initial packet via process bus transmission (step 38).

[0035] When the backup IED7 receives the initial packet, it verifies that the current program of the backup IED7 is the protective IED1 program 29 (step 39).

[0036] If the current program is the protective IED1 program 29, the backup IED7 disconnects from the MU8, decompresses the backup IED program 25 stored in the ROM 23, and rewrites the decompressed backup IED program 28 to the RAM 24. After the rewriting to the backup IED program 28 is complete, it is loaded to the CPU, and after the loading is complete, a CPU refresh is performed (step 40). As a result, the execution of the protective IED1 program 29 ends, and consequently, the operation in which the backup IED7 replaces the protective IED5-1 ends.

[0037] After refreshing, if the CPU 21 of the backup IED7 runs normally, the backup IED7 will not perform the monitoring and control of the digital substation system 1 or the protective relay behavior as before, but will instead monitor the transmission status between the protective IED5, the control IED6, and the MU8.

[0038] Furthermore, the system is restored when the backup IED7, after the transmission to MU8 is lost, recovers the protective IED5-1, which connects to MU8 on the process bus transmission side and to SC4 and GW3 on the station bus transmission side.

[0039] Furthermore, the system of the embodiment of the present invention may be configured as follows.

[0040] (1) A backup protection control device (e.g., a backup IED7) is connected to a plurality of merging units (e.g., MU8) and a plurality of protection control devices (e.g., protection IED5 and control IED6), each of which merging units is connected to at least one of an instrument for measuring the power system (e.g., instrument 9) and an instrument for controlling the power system (e.g., instrument 10), each of which protection control devices communicates with at least one of the merging units and has the function of performing calculations for the protection or control of the power system, the backup protection control device has a processor (e.g., CPU21) and memory (e.g., ROM23 and RAM24), and the memory is connected to the plurality of protection control The device maintains multiple protection control programs (for example, a protection IED program 26 and a control IED program 27) to implement each of the functions of the device. When the processor detects an abnormality in any of the multiple protection control devices, it determines whether the protection control program for implementing the functions of the protection control devices other than the one that detected the abnormality is being executed (for example, step 35). If the protection control program for implementing the functions of the protection control devices other than the one that detected the abnormality is not being executed, the processor starts executing the protection control program for implementing the functions of the protection control device that detected the abnormality (for example, step 36).

[0041] This allows for system reliability as a single system and cost reduction by providing one or a few spare IEDs for multiple protective IEDs and multiple control IEDs, without requiring two separate systems for protective and control IEDs.

[0042] (2) The auxiliary protection control device described in (1) above, wherein when the processor receives a predetermined packet (e.g., an initial packet) from the protection control device that detected the abnormality, it determines whether the protection control program for realizing the function of the protection control device that detected the abnormality is being executed (e.g., step 39), and if the protection control program for realizing the function of the protection control device that detected the abnormality is being executed, it terminates its execution (e.g., step 40).

[0043] This allows the system to revert to its previous state when a malfunctioning protective or control IED is restored.

[0044] (3) The auxiliary protection control device described in (2) above, wherein the processor detects the transmission state between each of the plurality of protection control devices and the plurality of merging units, and detects an abnormality in each of the plurality of protection control devices based on the transmission state (for example, steps 33, 34).

[0045] This allows for the proper detection of abnormalities in the protective control system.

[0046] (4) A backup protection control device as described in (3) above, wherein the processor identifies the merging units that are the transmitting and receiving partners of each of the plurality of protection control devices (for example, step 31), and for a protection control device in which two of the plurality of protection control devices have been identified as transmitting and receiving partners, if an abnormality is detected in the transmission with either of the two identified merging units, the processor detects an abnormality in the protection control device (for example, steps 32, 34), and for a protection control device in which three or more of the plurality of protection control devices have been identified as transmitting and receiving partners, if an abnormality is detected in the transmission with more than half of the three or more identified merging units, the processor detects an abnormality in the protection control device (for example, steps 32, 33).

[0047] This allows for the proper detection of abnormalities in the protective control system.

[0048] (5) The auxiliary protection control device described in (3) above, wherein the auxiliary protection control device is connected to the plurality of merging units and the plurality of protection control devices via a bus (e.g., process bus 12), and the processor monitors packets transmitted and received via the bus, and detects an abnormality in transmission between the merging unit and the protection control device if the protection control device does not respond to a packet transmitted from the merging unit.

[0049] This allows for the proper detection of abnormalities in the protective control system.

[0050] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are explained in detail for a better understanding of the present invention, and are not necessarily limited to those having all of the configurations described. Furthermore, it is possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is possible to add configurations from other embodiments to the configuration of one embodiment. In addition, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0051] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above configurations and functions may be implemented in software by a processor interpreting and executing programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in storage devices such as non-volatile semiconductor memory, hard disk drives, and SSDs (Solid State Drives), or in computer-readable non-temporary data storage media such as IC cards, SD cards, and DVDs.

[0052] Furthermore, the control lines and information lines shown are those deemed necessary for explanation purposes, and do not necessarily represent all control lines and information lines in the actual product. In practice, it can be assumed that almost all components are interconnected. [Explanation of Symbols]

[0053] 1…Digital substation system 2… Remote control system 3…Gateway (GW) 4…Direct Operation PC (SC) 5-1~N…Protection IED 6-1~M...Control IED 7… Spare IED 8-1~L…MU 9…Measurement (PT, CT) 10…Equipment (CB, LS) 11... Station bus 12… Process bus 21…CPU 22...Internal bus 23…ROM 24...RAM 25... Spare IED program (for memory) 26…Protection program (for memory) 27...Control program (for memory) 28…Backup IED Program (Operation) 29…Protective IED1 program (operation) 30…Anomaly / Recovery Detection Program

Claims

1. A backup protection control device connected to a plurality of merging units connected to at least one of an instrument for measuring a power system and equipment for controlling the power system, and a plurality of protection control devices having the function of communicating with at least one of the merging units and performing calculations for the protection or control of the power system, The aforementioned pre-protection control device has a processor and memory, The memory holds multiple protection control programs for realizing the functions of each of the multiple protection control devices, The aforementioned processor, If an abnormality is detected in any of the above-mentioned multiple protection control devices, it is determined whether the protection control program for implementing the functions of the protection control devices other than the protection control device that detected the abnormality is being executed. If the protection control program for realizing the functions of a protection control device other than the protection control device that detected the abnormality is not being executed, the execution of the protection control program for realizing the functions of the protection control device that detected the abnormality will be started. When a predetermined packet is received from the protection control device that detected the anomaly, it is determined whether the protection control program for realizing the function of the protection control device that detected the anomaly is being executed. A backup protection control device characterized in that, if the protection control program for realizing the function of the protection control device that detected the aforementioned abnormality is being executed, the execution of the program is terminated.

2. A pre-protection control device according to Claim 1, The processor is characterized by detecting the transmission state between each of the plurality of protection control devices and the plurality of merging units, and detecting an abnormality in each of the plurality of protection control devices based on the transmission state.

3. A preliminary protection control device according to Claim 2, The aforementioned processor, Identify the merging unit that is the transmitting and receiving partner with each of the plurality of protection control devices, Of the aforementioned plurality of protection control devices, if an abnormality is detected in the transmission with either of the two specified merging units, the protection control device will be detected as having an abnormality. A backup protection control device is characterized in that, among the plurality of protection control devices, if a protection control device for which three or more merging units have been identified as the transmitting and receiving partners detects an abnormality in transmission with more than half of the three or more identified merging units, the backup protection control device detects an abnormality in the said protection control device.

4. The pre-protection control device according to Claim 2, The aforementioned auxiliary protection control device is connected to the plurality of merging units and the plurality of protection control devices via a bus. The backup protection control device is characterized in that the processor monitors packets transmitted and received via the bus, and detects an abnormality in transmission between the merging unit and the protection control device if the protection control device does not respond to packets transmitted from the merging unit.

5. An anomaly detection and recovery method using a backup protection control device connected to a plurality of merging units connected to at least one of an instrument for measuring a power system and equipment for controlling the power system, and a plurality of protection control devices having the function of communicating with at least one of the merging units and performing calculations for the protection or control of the power system, The aforementioned pre-protection control device has a processor and memory, The memory holds multiple protection control programs for realizing the functions of each of the multiple protection control devices, The aforementioned anomaly detection and recovery method is: If the processor detects an abnormality in any of the plurality of protection control devices, the first step is to determine whether the protection control program for implementing the functions of the protection control devices other than the protection control device that detected the abnormality is being executed. If the protection control program for realizing the functions of a protection control device other than the protection control device that detected the abnormality is not being executed, the processor starts executing the protection control program for realizing the functions of the protection control device that detected the abnormality, in a second step. A third step in which, when the processor receives a predetermined packet from the protection control device that detected the anomaly, it determines whether the protection control program for realizing the function of the protection control device that detected the anomaly is being executed. An anomaly detection and recovery method, characterized by comprising: a fourth step of terminating the execution of the protection control program if it is running to implement the function of the protection control device that has detected the anomaly.

6. An anomaly detection and recovery method according to Claim 5, An anomaly detection and recovery method characterized in that, in the first step, the processor detects the transmission state between each of the plurality of protection control devices and the plurality of merging units, and detects an anomaly in each of the plurality of protection control devices based on the transmission state.

7. An anomaly detection and recovery method according to Claim 6, In the first step, the processor, Identify the merging unit that is the transmitting and receiving partner with each of the plurality of protection control devices, Of the aforementioned plurality of protection control devices, if an abnormality is detected in the transmission with either of the two specified merging units, the protection control device will be detected as having an abnormality. An abnormality detection and recovery method characterized in that, among the plurality of protection control devices, if an abnormality is detected in transmission with more than half of the three or more specified merging units, an abnormality of the protection control device is detected.

8. An anomaly detection and recovery method according to Claim 6, The aforementioned auxiliary protection control device is connected to the plurality of merging units and the plurality of protection control devices via a bus. An anomaly detection and recovery method characterized in that, in the first step, the processor monitors packets transmitted and received via the bus, and if the protection control device does not respond to a packet transmitted from the merging unit, it detects an anomaly in the transmission between the merging unit and the protection control device.

9. A protective control system, The system comprises: a plurality of merging units connected to at least one of an instrument for measuring the power system and equipment for controlling the power system; a plurality of protection control devices having the function of communicating with at least one of the merging units and performing calculations for the protection or control of the power system; and one or more auxiliary protection control devices connected to the plurality of merging units and the plurality of protection control devices. The number of the aforementioned auxiliary protection control devices is less than the number of the aforementioned protection control devices. The aforementioned pre-protection control device has a processor and memory, The memory holds multiple protection control programs for realizing the functions of each of the multiple protection control devices, The aforementioned processor, If an abnormality is detected in any of the above-mentioned multiple protection control devices, it is determined whether the protection control program for implementing the functions of the protection control devices other than the protection control device that detected the abnormality is being executed. If the protection control program for realizing the functions of a protection control device other than the protection control device that detected the abnormality is not being executed, the execution of the protection control program for realizing the functions of the protection control device that detected the abnormality will be started. When a predetermined packet is received from the protection control device that detected the anomaly, it is determined whether the protection control program for realizing the function of the protection control device that detected the anomaly is being executed. A protection control system characterized in that, when the protection control program for realizing the function of the protection control device that detected the aforementioned abnormality is being executed, the execution of the program is terminated.

Images