Plant Control Systems

Abstract

A control system with a simple configuration that can reliably block operation signals from a regular operation terminal is provided. The control system (1) is composed of a safety system operation terminal (2) through which an operator monitors and operates the safety system equipment (12), a normal system operation terminal (3) through which an operator monitors and operates the normal system equipment (13) and the safety system equipment, a control unit (4) that receives operation signals from the safety system operation terminal and the normal system operation terminal and outputs control signals to the plant equipment (10), a safety system network (22), and a normal system network (23). The control unit has a function of invalidating operation signals transmitted from the normal system network when monitoring operations are performed from the safety system operation terminal.

Description

[Technical Field]

[0001] The present application relates to a plant control system. [Background technology]

[0002] Control systems that control plants such as nuclear power plants are required to have the ability to bring the plant to a safe state when an abnormality occurs in the plant. Therefore, plant control systems are composed of a normal system that operates the plant normally and a safety system that brings the plant to a safe state. Such control systems are equipped with a normal system operation terminal corresponding to the normal system and a safety system operation terminal corresponding to the safety system. During normal plant operation, an operator monitors and operates the plant by using the normal system operation terminal to send operation signals to normal system equipment, such as pumps, valves, and circuit breakers. When an abnormality occurs in the plant, an operator monitors and operates the plant by using the safety system operation terminal to send operation signals to safety system equipment, such as coolers and disconnectors.

[0003] However, during normal operation, operators monitor and operate the plant using a normal operation terminal, but when an abnormality occurs, they must operate a safety operation terminal, which is different from the normal operation terminal, which makes plant monitoring operations complicated.

[0004] As a conventional plant control system that addresses such problems, there is a control system in which the normal operation terminal also has a function for transmitting operation signals to safety-system devices. In this control system, when an abnormality occurs in the plant, the operator can transmit an operation signal from the normal operation terminal to the safety-system devices. When the normal operation terminal breaks down and cannot be operated, the operator transmits an operation signal from the safety-system operation terminal to the safety-system devices. In this case, the operation signal from the normal operation terminal to the safety-system devices is blocked (see, for example, Patent Document 1 and Patent Document 2). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2012-78167 [Patent Document 2] Japanese Patent Application Laid-Open No. 2012-103013 Summary of the Invention [Problem to be solved by the invention]

[0006] In conventional plant control systems, a disconnection circuit is installed in the path that transmits operation signals from the normal operation terminal to each safety device. When an operator transmits an operation signal from the safety operation terminal to each safety device, this disconnection circuit is used to block the operation signal from the normal operation terminal to the safety device. Therefore, in conventional plant control systems, it is necessary to provide a disconnection circuit according to the number of safety devices, which causes the problem of the device becoming complex and large. If the disconnection circuit is implemented as software, the device size can be avoided, but the problem of the software becoming complex is that a software-based disconnection circuit (logic circuit) is required according to the number of safety devices.

[0007] The present application has been made to solve the above-mentioned problems, and aims to provide a control system with a simple configuration that does not require the installation of disconnection circuits according to the number of safety-system devices, and that can reliably block operation signals from a regular-use operation terminal to safety-system devices when an operator sends an operation signal from the safety-system operation terminal to the safety-system devices. [Means for solving the problem]

[0008] The plant control system of the present application comprises a safety system operation terminal for monitoring and operating the safety system devices, a normal system operation terminal for monitoring and operating the normal system devices and the safety system devices, a control unit that receives operation signals from the safety system operation terminal and the normal system operation terminal and outputs control signals to plant devices including the safety system devices and the normal system devices, a safety system network that transmits operation signals from the safety system operation terminal to the control unit, and a normal system network that transmits operation signals from the normal system operation terminal to the control unit. The control unit has a function of invalidating operation signals transmitted from the normal system network when monitoring operations for the safety system devices are performed from the safety system operation terminal. The safety-system operation terminal includes a block signal transmission unit, and the control unit invalidates an operation signal transmitted from the normal-use network based on a block signal transmitted from the block signal transmission unit. The control unit includes a safety-system communication module that receives the operation signal transmitted from the safety-system network, a normal-use communication module that receives the operation signal transmitted from the normal-use network, and a calculation module that calculates a control signal for controlling plant equipment. The control unit invalidates the operation signal transmitted from the normal-use network by stopping data transfer from the normal-use communication module to the calculation module based on the block signal. is doing. Another plant control system of the present application is a plant control system that is configured with a safety system operation terminal for monitoring and operating safety system devices, a normal system operation terminal for monitoring and operating normal system devices and safety system devices, a control unit that receives operation signals from the safety system operation terminal and the normal system operation terminal and outputs control signals to plant devices including the safety system devices and the normal system devices, a safety system network that transmits operation signals from the safety system operation terminal to the control unit, and a normal system network that transmits operation signals from the normal system operation terminal to the control unit, and the control unit receives operation signals transmitted from the normal system network when a monitoring operation of the safety system devices is performed from the safety system operation terminal. The control unit further includes a block signal terminal connected to the control unit by wiring and having a function of disabling the operation signal transmitted from the normal system network based on the block signal sent from the block signal terminal. The control unit includes a safety system communication module that receives the operation signal transmitted over the safety system network, a normal system communication module that receives the operation signal transmitted over the normal system network, and a calculation module that calculates control signals for controlling plant equipment. The control unit disables the operation signal transmitted from the normal system network by stopping the transfer of data from the normal system communication module to the calculation module based on the block signal. [Effects of the Invention]

[0009] In the plant control system of the present application, the control unit The system is equipped with a safety system communication module that receives operation signals transmitted over a safety system network, a normal system communication module that receives operation signals transmitted over a normal system network, and a calculation module that calculates control signals for controlling plant equipment. The system disables operation signals transmitted from the normal system network by stopping data transfer from the normal system communication module to the calculation module based on a block signal. This simplifies the configuration of the control system. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a configuration diagram of a plant control system according to a first embodiment. [Figure 2] 2 is a configuration diagram of a control unit of the plant control system according to the first embodiment. FIG. [Figure 3] 4 is a flowchart showing the operation of a calculation module of the plant control system according to the first embodiment. [Figure 4] FIG. 10 is a configuration diagram of a plant control system according to a second embodiment. [Figure 5] FIG. 10 is a configuration diagram of a control unit of a plant control system according to a second embodiment. [Figure 6] 10 is a flowchart showing the operation of a calculation module of the plant control system according to the second embodiment. [Figure 7] FIG. 10 is a configuration diagram of a plant control system according to a third embodiment. [Figure 8]FIG. 2 is a diagram showing an example of a hardware configuration of a control unit of a plant control system according to the first to third embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, a plant control system according to an embodiment of the present invention will be described in detail with reference to the drawings. In the drawings, the same reference numerals indicate the same or corresponding parts.

[0012] Embodiment 1 FIG. 1 is a configuration diagram of a plant control system according to a first embodiment. The plant control system 1 of this embodiment includes a safety system operation terminal 2, a normal system operation terminal 3, a control unit 4, and a block signal terminal 5. The control system 1 is a system for controlling plant equipment 10 including safety system equipment 12 and normal system equipment 13. The plant equipment 10 is, for example, plant equipment that constitutes a nuclear power plant. Examples of the safety system equipment 12 include coolers and disconnecting switches. Examples of the normal system equipment 13 include pumps, valves, and circuit breakers.

[0013] The safety system operation terminal 2 is a terminal used by an operator to monitor and operate the safety system devices 12 of the plant equipment 10. The safety system operation terminal 2 is connected to the control unit 4 via a safety system network 22. The safety system operation terminal 2 transmits an operation signal to the control unit 4 via the safety system network 22, and receives information about the safety system devices 12 from the control unit 4.

[0014] The normal system operation terminal 3 is a terminal used by an operator to monitor and operate the safety system devices 12 and normal system devices 13 of the plant equipment 10. The normal system operation terminal 3 is connected to the control unit 4 via a normal system network 23. The normal system operation terminal 3 transmits operation signals to the control unit 4 via the normal system network 23, and receives information on the safety system devices 12 and normal system devices 13 from the control unit 4. The safety system network 22 and the normal system network 23 are independent from each other. However, the safety system network 22 and the normal system network 23 do not necessarily have to be independent from each other.

[0015] For example, a VDU (Video Display Unit) is used as the safety system operation terminal 2 and the regular system operation terminal 3. A VDU is a terminal device that operates a computer, and is equipped with a display function that displays images presented from the computer to the user, and an input function that receives commands from the user to instruct the computer. Specific examples of VDUs include tablets, smartphones, and stationary touch panel displays.

[0016] The control unit 4 receives operation signals from the safety system operation terminal 2 and the normal system operation terminal 3. The control unit 4 generates a control signal for the plant device 10 based on the operation signals received from the safety system operation terminal 2 and the normal system operation terminal 3, and transmits the generated control signal to the plant device 10.

[0017] The block signal terminal 5 is provided separately from the safety system operation terminal 2 and the normal system operation terminal 3. The block signal terminal 5 is connected to the control unit 4 by a wire 51. The block signal terminal 5 is provided so that the operator can send a block signal when the normal system operation terminal 3 fails or the operator is unable to monitor and operate the plant equipment 10 using the normal system operation terminal 3. The block signal terminal 5 sends a block signal to the control unit 4 in response to the operator's operation. The block signal terminal 5 is, for example, an analog switch.

[0018] 2 is a configuration diagram of a control unit of a plant control system according to this embodiment. The control unit 4 of this embodiment includes a safety-system communication module 42, a normal-system communication module 43, and a calculation module 44. An operation signal transmitted from the safety-system network 22 is received by the safety-system communication module 42. The safety-system communication module 42 stores the received operation signal in an internal safety-system communication memory 421. An operation signal transmitted from the normal-system network 23 is received by the normal-system communication module 43. The normal-system communication module 43 stores the received operation signal in an internal normal-system communication memory 431.

[0019] The calculation module 44 is connected to the safety system communication module 42 and the normal system communication module 43 via an internal network 45. The calculation module 44 reads data from the safety system communication memory 421 and the normal system communication memory 431 at regular intervals and stores the read data in an internal calculation memory 441. The calculation module 44 calculates a control signal for controlling the plant device 10 in an internal control signal calculation unit 442 based on the data stored in the calculation memory 441. The control unit 4 outputs the control signal calculated by the calculation module 44 to the plant device 10.

[0020] The control unit 4 is connected to the block signal terminal 5 by a wire 51, and the block signal is input to the calculation module 44. As will be described later, the calculation module 44 selects data to be stored in the calculation memory 441 based on the input of the block signal.

[0021] Next, the operation of the plant control system 1 in this embodiment will be described. When the plant equipment 10 is operating normally, the plant equipment 10 is operated by an operator who monitors it using the normal operation terminal 3. When an abnormality occurs in the plant equipment 10, the operator must monitor the safety system equipment 12 to bring the plant equipment 10 to a safe state. The normal operation terminal 3 has the function of monitoring and operating both the safety system equipment 12 and the normal system equipment 13 of the plant equipment 10, so the operator can immediately deal with the abnormality using the normal operation terminal 3.

[0022] When the operator is unable to monitor and operate the plant equipment 10 using the normal operation terminal 3 due to a malfunction of the normal operation terminal 3 or other reasons, the operator must use the safety operation terminal 2 to bring the plant equipment 10 to a safe state. In this case, the operator operates the block signal terminal 5 to send a block signal to the control unit 4, and operates the safety operation terminal 2 to send an operation signal to the safety equipment 12 to the control unit 4. At this time, the operation signal from the normal operation terminal 3 to the safety equipment 12 must be blocked. This is because, depending on the state of the malfunction of the normal operation terminal 3, an erroneous operation signal may be sent from the normal operation terminal 3 to the safety equipment 12.

[0023] 3 is a flowchart showing the operation of the calculation module of the plant control system according to this embodiment. In step S01, the calculation module 44 reads data from the safety-system communication memory 421. Next, in step S02, the calculation module 44 checks whether a block signal has been input. If no block signal has been input (NO) in step S02, the calculation module 44 proceeds to step S03. In step S03, the calculation module 44 reads data from the normal-system communication memory 431. Next, the calculation module 44 proceeds to step S04. If a block signal has been input (YES) in step S02, the calculation module 44 proceeds to step S04.

[0024] In step S04, the calculation module 44 stores the read data in the calculation memory 441. Then, the calculation module 44 calculates a control signal for controlling the plant equipment 10 in an internal control signal calculation unit 442 based on the data stored in the calculation memory 441. The control unit 4 outputs the control signal calculated by the calculation module 44 to the plant equipment 10.

[0025] In the plant control system configured in this manner, when a block signal is input, the transfer of data from the normal system communication module 43 to the calculation module 44 is stopped, thereby invalidating the operation signal transmitted from the normal system network 23. Therefore, in this control system, when an operation signal is transmitted from the safety system operation terminal 2 to the safety system device 12, the operation signal from the normal system operation terminal 3 to the safety system device 12 can be reliably blocked. Furthermore, this control system does not require the provision of a disconnection circuit for the operation signal transmitted from the normal system operation terminal 3 in accordance with the number of safety system devices 12, thereby simplifying the configuration.

[0026] Furthermore, in the plant control system of this embodiment, if the safety system network 22 and the normal system network 23 are independent of each other, an operation signal to the safety system device 12 is reliably transmitted through the safety system network 22 even when the normal system network 23 is cut off due to an unexpected cause.

[0027] In the plant control system of this embodiment, when a block signal is input, the calculation module 44 does not read data from the normal system communication memory 431. In this case, the data in the area of ​​the calculation memory 441 into which data is read from the normal system communication memory 431 is changed to preset data, or the data read before the block signal is input is held.

[0028] As described above, the plant control system of this embodiment is composed of a safety system operation terminal for monitoring and operating the safety system devices, a normal system operation terminal for monitoring and operating the normal system devices and the safety system devices, a control unit that receives operation signals from the safety system operation terminal and the normal system operation terminal and outputs control signals to plant equipment including the safety system devices and the normal system devices, a safety system network that transmits operation signals from the safety system operation terminal to the control unit, and a normal system network that transmits operation signals from the normal system operation terminal to the control unit. The control unit has a function of invalidating operation signals transmitted from the normal system network when monitoring operations of the safety system devices are performed from the safety system operation terminal.

[0029] A plant control system configured in this manner can reliably block operation signals from the normal operation terminal to the safety system equipment when transmitting operation signals from the safety system operation terminal to the safety system equipment, and has a simple configuration.

[0030] Embodiment 2 4 is a configuration diagram of a plant control system according to embodiment 2. The plant control system 1 of this embodiment includes a safety system operation terminal 2, a normal system operation terminal 3, and a control unit 4. The control system 1 is a system for controlling plant equipment 10 including safety system equipment 12 and normal system equipment 13. The plant equipment 10 is, for example, plant equipment that constitutes a nuclear power plant.

[0031] The safety system operation terminal 2 is a terminal used by an operator to monitor and operate the safety system devices 12 of the plant equipment 10. The safety system operation terminal 2 is connected to the control unit 4 via a safety system network 22. The safety system operation terminal 2 transmits an operation signal to the control unit 4 via the safety system network 22, and receives information about the safety system devices 12 from the control unit 4.

[0032] The normal system operation terminal 3 is a terminal used by an operator to monitor and operate the safety system devices 12 and normal system devices 13 of the plant equipment 10. The normal system operation terminal 3 is connected to the control unit 4 via a normal system network 23. The normal system operation terminal 3 transmits operation signals to the control unit 4 via the normal system network 23, and receives information on the safety system devices 12 and normal system devices 13 from the control unit 4. The safety system network 22 and the normal system network 23 are independent from each other. However, the safety system network 22 and the normal system network 23 do not necessarily have to be independent from each other.

[0033] The control unit 4 receives operation signals from the safety system operation terminal 2 and the normal system operation terminal 3. The control unit 4 generates a control signal for the plant device 10 based on the operation signals received from the safety system operation terminal 2 and the normal system operation terminal 3, and transmits the generated control signal to the plant device 10.

[0034] In the plant control system of this embodiment, the safety system operation terminal 2 includes a block signal transmission unit 20. The block signal transmission unit 20 is provided so that the operator can transmit a block signal when the operator is unable to monitor and operate the plant equipment 10 using the normal operation terminal 3, for example, when the normal operation terminal 3 breaks down. The block signal transmission unit 20 transmits a block signal to the control unit 4 via the safety system network 22 in response to an operation by the operator.

[0035] 5 is a configuration diagram of a control unit of a plant control system according to this embodiment. The control unit 4 of this embodiment includes a safety-system communication module 42, a normal-system communication module 43, and a calculation module 44. An operation signal transmitted from the safety-system network 22 is received by the safety-system communication module 42. The safety-system communication module 42 stores the received operation signal in an internal safety-system communication memory 421. The safety-system communication module 42 also stores a block signal transmitted via the safety-system network 22 in an internal block signal memory 422. An operation signal transmitted from the normal-system network 23 is received by the normal-system communication module 43. The normal-system communication module 43 stores the received operation signal in an internal normal-system communication memory 431.

[0036] The calculation module 44 is connected to the safety-system communication module 42 and the normal-system communication module 43 via an internal network 45. The calculation module 44 reads data from the safety-system communication memory 421 and the normal-system communication memory 431 at regular intervals and stores the read data in an internal calculation memory 441. The calculation module 44 also reads data from the block signal memory 422 of the safety-system communication module 42 and determines whether a block signal has been input from the safety-system operation terminal 2. The calculation module 44 calculates a control signal for controlling the plant device 10 in an internal control signal calculation unit 442 based on the data stored in the calculation memory 441. The control unit 4 outputs the control signal calculated by the calculation module 44 to the plant device 10.

[0037] Next, the operation of the plant control system 1 in this embodiment will be described. When the plant equipment 10 is operating normally, the plant equipment 10 is operated by an operator who monitors it using the normal operation terminal 3. When an abnormality occurs in the plant equipment 10, the operator must monitor the safety system equipment 12 to bring the plant equipment 10 to a safe state. The normal operation terminal 3 has the function of monitoring and operating both the safety system equipment 12 and the normal system equipment 13 of the plant equipment 10, so the operator can immediately deal with the abnormality using the normal operation terminal 3.

[0038] When the operator is unable to monitor and operate the plant equipment 10 using the normal operation terminal 3 due to a malfunction of the normal operation terminal 3 or other reasons, the operator must bring the plant equipment 10 to a safe state using the safety operation terminal 2. In this case, the operator operates the safety operation terminal 2 to send a block signal from the block signal transmitter 20 to the control unit 4, and also operates the safety operation terminal 2 to send an operation signal to the safety equipment 12 to the control unit 4. At this time, the operation signal from the normal operation terminal 3 to the safety equipment 12 must be blocked.

[0039] 6 is a flowchart showing the operation of the calculation module of the plant control system according to this embodiment. In step S11, the calculation module 44 reads data from the safety-system communication memory 421. Next, in step S12, the calculation module 44 reads data from the block signal memory 422. Next, in step S13, the calculation module 44 checks whether a block signal has been input. If no block signal has been input (NO) in step S13, the calculation module 44 proceeds to step S14. In step S14, the calculation module 44 reads data from the normal-system communication memory 431. Next, the calculation module 44 proceeds to step S15. If a block signal has been input (YES) in step S13, the calculation module 44 proceeds to step S15.

[0040] In step S15, the calculation module 44 stores the read data in the calculation memory 441. Then, the calculation module 44 calculates a control signal for controlling the plant equipment 10 in an internal control signal calculation unit 442 based on the data stored in the calculation memory 441. The control unit 4 outputs the control signal calculated by the calculation module 44 to the plant equipment 10.

[0041] In the plant control system configured in this manner, when a block signal is input, the transfer of data from the normal system communication module 43 to the calculation module 44 is stopped, thereby invalidating the operation signal transmitted from the normal system network 23. Therefore, in this control system, when an operation signal is transmitted from the safety system operation terminal 2 to the safety system device 12, the operation signal from the normal system operation terminal 3 to the safety system device 12 can be reliably blocked. Furthermore, this control system does not require the provision of a disconnection circuit for the operation signal transmitted from the normal system operation terminal 3 in accordance with the number of safety system devices 12, thereby simplifying the configuration.

[0042] Furthermore, in the plant control system of this embodiment, the safety system operation terminal 2 has the block signal transmission unit 20, so there is no need to provide a block signal terminal separate from the safety system operation terminal 2. Therefore, the plant control system of this embodiment has an even simpler configuration than the plant control system of the first embodiment.

[0043] Furthermore, in the plant control system of this embodiment, when a block signal is input, the transfer of data from the normal communication module 43 to the calculation module 44 is simply stopped, so there is no need for a software isolation circuit (logic circuit) according to the number of safety devices. Therefore, the plant control system of this embodiment has a simple software configuration.

[0044] In the plant control system of this embodiment, when a block signal is input, the calculation module 44 does not read data from the normal system communication memory 431. In this case, the data in the area of ​​the calculation memory 441 into which data is read from the normal system communication memory 431 is changed to preset data, or the data read before the block signal is input is held.

[0045] Embodiment 3 7 is a configuration diagram of a plant control system according to a third embodiment. The plant control system 1 of this embodiment includes a safety system operation terminal 2, a normal system operation terminal 3, a control unit 4, and a block signal terminal 5. The control system 1 is a system for controlling plant equipment 10 including safety system equipment 12 and normal system equipment 13. The plant equipment 10 is, for example, plant equipment that constitutes a nuclear power plant.

[0046] The safety system operation terminal 2 is a terminal used by an operator to monitor and operate the safety system devices 12 of the plant equipment 10. The safety system operation terminal 2 is connected to the control unit 4 via a safety system network 22. The safety system operation terminal 2 transmits an operation signal to the control unit 4 via the safety system network 22, and receives information about the safety system devices 12 from the control unit 4.

[0047] The normal system operation terminal 3 is a terminal used by an operator to monitor and operate the safety system devices 12 and normal system devices 13 of the plant equipment 10. The normal system operation terminal 3 is connected to the control unit 4 via a normal system network 23. The normal system operation terminal 3 transmits operation signals to the control unit 4 via the normal system network 23, and receives information on the safety system devices 12 and normal system devices 13 from the control unit 4. The safety system network 22 and the normal system network 23 are independent of each other.

[0048] The control unit 4 receives operation signals from the safety system operation terminal 2 and the normal system operation terminal 3. The control unit 4 generates control signals for the plant device 10 based on the operation signals received from the safety system operation terminal 2 and the normal system operation terminal 3, and transmits the generated control signals to the plant device 10. The configuration of the control unit 4 is the same as the configuration of the control unit shown in FIG. 2 of the first embodiment.

[0049] The block signal terminal 5 is provided separately from the safety system operation terminal 2 and the normal system operation terminal 3. The block signal terminal 5 is connected to a disconnection circuit 53 by a wiring 51. The disconnection circuit 53 is provided in the normal system network 23. The disconnection circuit 53 has the function of electrically disconnecting the normal system network 23. When a block signal is input from the block signal terminal 5, the disconnection circuit 53 cuts off the transmission of operation signals on the normal system network 23. The block signal terminal 5 is provided so that the operator can send a block signal when the operator is unable to monitor and operate the plant equipment 10 using the normal system operation terminal 3, for example, when the normal system operation terminal 3 breaks down. The block signal terminal 5 sends a block signal to the disconnection circuit 53 when operated by the operator.

[0050] When the operator is unable to monitor and operate the plant equipment 10 using the normal system operation terminal 3 due to a malfunction of the normal system operation terminal 3 or other reasons, the operator must bring the plant equipment 10 to a safe state using the safety system operation terminal 2. In this case, the operator operates the block signal terminal 5 to send a block signal to the disconnection circuit 53, and operates the safety system operation terminal 2 to send an operation signal to the safety system equipment 12 to the control unit 4. When a block signal is input from the block signal terminal 5, the disconnection circuit 53 cuts off the transmission of the operation signal on the normal system network 23.

[0051] In the plant control system configured in this manner, when a block signal is input, the disconnection circuit 53 cuts off the normal network 23, thereby invalidating the operation signal transmitted from the normal network 23. Therefore, in this control system, when an operation signal is transmitted from the safety-system operation terminal 2 to the safety-system device 12, the operation signal from the normal operation terminal 3 to the safety-system device 12 can be reliably cut off. Furthermore, this control system has a simple configuration because it can cut off all operation signals transmitted from the normal operation terminal 3 to the safety-system device 12 with one disconnection circuit.

[0052] In the plant control system of this embodiment, when a block signal is input, the operation signal from the normal operation terminal 3 is not input to the control unit 4. Therefore, the calculation module 44 of the control unit 4 holds the data that was read before the block signal was input. In addition, when the control unit 4 can recognize that a block signal has been input to the disconnection circuit 53, the calculation module 44 may change the data in the area where data is read from the normal communication memory 431 of the calculation memory 441 to preset data.

[0053] The control unit 4 of the plant control system according to the first to third embodiments includes a processor 50 and a storage device 60, as shown in FIG. 8 , which is an example of hardware. The storage device 60 includes a volatile storage device such as a random access memory and a non-volatile auxiliary storage device such as a flash memory, although these are not shown. A hard disk auxiliary storage device may be used instead of the flash memory. The processor 50 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), an integrated circuit (IC), a field programmable gate array (FPGA), various logic circuits, and various signal processing circuits. A plurality of processors 50, either of the same type or of different types, may be provided, and each process may be shared among them.

[0054] The processor 50 executes a program input from the storage device 60. In this case, the program is input from the auxiliary storage device to the processor 50 via the volatile storage device. The processor 50 may also output data such as calculation results to the volatile storage device of the storage device 60, or may store the data in the auxiliary storage device via the volatile storage device.

[0055] Although the present application describes various exemplary embodiments, the various features, aspects, and functions described in one or more embodiments are not limited to application to a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless variations not illustrated are conceivable within the scope of the technology disclosed in this application, including, for example, cases where at least one component is modified, added, or omitted, and cases where at least one component is extracted and combined with a component of another embodiment. [Explanation of symbols]

[0056] 1 control system, 2 safety system operation terminal, 3 normal system operation terminal, 4 control unit, 5 block signal terminal, 10 plant equipment, 12 safety system equipment, 13 normal system equipment, 20 block signal transmission unit, 22 safety system network, 23 normal system network, 42 ​​safety system communication module, 43 normal system communication module, 44 calculation module, 45 internal network, 50 processor, 51 wiring, 53 disconnection circuit, 60 storage device, 421 safety system communication memory, 422 block signal memory, 431 normal system communication memory, 441 calculation memory, 442 control signal calculation unit.

Claims

1. a safety system operation terminal for monitoring and operating the safety system devices; a normal system operation terminal for monitoring and operating the normal system devices and the safety system devices; a control unit that receives operation signals from the safety system operation terminal and the normal system operation terminal and outputs control signals to plant devices including the safety system devices and the normal system devices; a safety system network that transmits an operation signal from the safety system operation terminal to the control unit; A plant control system configured with a normal system network that transmits an operation signal from the normal system operation terminal to the control unit, the control unit has a function of invalidating an operation signal transmitted from the regular network when a monitoring operation for the safety-system device is performed from the safety-system operation terminal, the safety system operation terminal includes a block signal transmission unit, The control unit invalidates an operation signal transmitted from the regular network based on a block signal transmitted from the block signal transmission unit, The control unit includes a safety system communication module that receives an operation signal transmitted through the safety system network, a normal system communication module that receives an operation signal transmitted through the normal system network, and an arithmetic module that calculates a control signal for controlling the plant equipment, and is characterized in that the operation signal transmitted from the normal system network is invalidated by stopping the transfer of data from the normal system communication module to the arithmetic module based on the block signal.

2. A safety system operation terminal for monitoring and operating a safety system device; a normal system operation terminal for monitoring and operating the normal system devices and the safety system devices; a control unit that receives operation signals from the safety system operation terminal and the normal system operation terminal and outputs control signals to plant devices including the safety system devices and the normal system devices; a safety system network that transmits an operation signal from the safety system operation terminal to the control unit; A plant control system configured with a normal system network that transmits an operation signal from the normal system operation terminal to the control unit, the control unit has a function of invalidating an operation signal transmitted from the regular network when a monitoring operation for the safety-system device is performed from the safety-system operation terminal, A block signal terminal connected to the control unit by wiring is further provided. The control unit invalidates an operation signal transmitted from the normal network based on a block signal transmitted from the block signal terminal, The control unit includes a safety system communication module that receives an operation signal transmitted through the safety system network, a normal system communication module that receives an operation signal transmitted through the normal system network, and an arithmetic module that calculates a control signal for controlling the plant equipment, and is characterized in that the operation signal transmitted from the normal system network is invalidated by stopping the transfer of data from the normal system communication module to the arithmetic module based on the block signal.

Images