FIELD OF THE INVENTION

The present invention relates to the control of electrical switching systems, particularly software controlled systems that control and monitor equipment/plant located at a significant distance from the operator, and particularly electrical switchgear control systems,

BACKGROUND ART

In a system for transmitting electricity, or an electric power system, switchgear is the term used to refer to the combination of electrical connect/disconnect switches, fuses or circuit breakers used to control, protect and isolate electrical equipment. Switchgear is used both to de-energize equipment to allow work to be done and to clear faults downstream. High-voltage switchgear was invented at the end of the 19th century for operating motors and other electric machines. The technology has been improved over time and can now be used with voltages up to 1,100 kV. In high-voltage power transmission systems, substations for stepping down voltage have large transformers, and switchgear is typically located on both the high-voltage and the low-voltage sides of the transformers. One of the basic functions of switchgear is protection, which is interruption of short-circuit and overload fault currents while maintaining service to unaffected circuits. Switchgear also provides isolation of circuits from power supplies. Switchgear is also used to enhance system availability by allowing more than one source to feed a load. It follows that switchgear must be carefully controlled so as to ensure that only safe operation sequences of switchgear is allowed. A switchgear control system may operate and monitor many control points, and it is important that only safe combinations of control point states are allowed, and that unsafe combinations are inhibited from arising. In the context of the present invention, "safe" (or acceptable) means that operation in this state will cause no danger or damage to other equipment forming part of the switchgear system or to which the switchgear is directly connected/controlling, or to any operators; "unsafe" (or unacceptable) should be construed accordingly. Also, control points are often operated or actuated in common, however it could be unsafe to operate some control points simultaneously, either in absolute terms or dependent upon the combination of other control point states. Many modern switchgear control systems are operated entirely by software, which can be collocated with or remote from the system, but software cannot be guaranteed to prevent unsafe operation. For example, software updates may introduce errors which have safety implications, in very complex systems the software itself is complex and unexpected errors may arise, in the software itself, or because of some external influence which the software is unable to detect or to compensate for (such as mechanical or other failure). In addition, switchgear control systems may be operated remotely, or operators may need to operate them in situ - for example, when commissioning, maintaining or repairing equipment. What is safe operation of the switchgear when the operator is remote may not be safe when the operator is in close proximity to the switchgear; further, when an operator is co-located with the switchgear, the operator may have reason to operate the switchgear manually, and to override some of the software routines for perfectly valid reasons, however it is in such situations that safety becomes an issue, because the software may not be able to prevent the operator from moving the switchgear to a state which is unsafe.

SUMMARY OF THE INVENTION

We have realised that a simple yet reliable interlock system would be desirable. Accordingly, in a first aspect the present invention provides a method of controlling a switchgear control system for controlling at least two devices, the system comprising; at least one processor; a plurality of control switches for selectively actuating the devices and moveable between at least two states, and a plurality of sensors, wherein the processor is programmed with combinations of control switch states which are acceptable and combinations which are unacceptable, and is adapted to actuate the control switches between states, wherein the sensors sense the state of the control switches and send signals representing the control switch states to the processor, and wherein the programmed processor is adapted to monitor the signals representing the states of the control switches and to generate at least one guard signal effective so as to inhibit actuation of at least one control switch so as to prevent unacceptable combinations of control switch states arising, wherein the method comprises monitoring the combination of control switch states independently of the processor, determining if the movement of at least one control switch from one state to another would create a combination of control switch states with at least one other control switch which is unacceptable and, if so, generating additional guard signals to prevent the at least one control switch from moving to the state which, in combination with the state of the at least one other control switch, is unacceptable,

The invention also provides an electrical switchgear control system for controlling at least two devices comprising: at least one processor; a plurality of control switches for selectively actuating the devices and moveable between at least two states, and a plurality of sensors, wherein the processor is programmed with combinations of control switch states which are acceptable and combinations which are unacceptable, and is adapted to actuate the control switches between states, wherein the sensors are adapted to sense the state of the control switches and to send signals representing the control switch states to the processor, and wherein the programmed processor is adapted to monitor the signals representing the states of the control switches and to generate at least one guard signal effective so as to inhibit actuation of at least one control switch so as to prevent unacceptable combinations of control switch states arising, wherein the system further comprises at least one logic circuit adapted to monitor the combination of control switch states independently of the processor, to determine if the movement of at least one control switch from one state to another would create a combination of control switch states with at least one other control switch which is unacceptable and, if so, to generate additional guard signals to prevent the at least one control switch from moving to the state which, in combination with the state of the at least one other control switch, is unacceptable.

Such arrangements permit the safe operation of switchgear control systems obviating concerns about the inherent unreliability of software in complex systems, are effective whether the operator is remote or co-located with the switchgear and addresses the problem that a co-located operator may inadvertently try and operate the switchgear in an unsafe manner, and they can cope with many external influences far better than can a software-only system, The guard signals can be common to ail control switches, or to a particular subset or subsets of control switches, or they can be directed to a specific control switch.

The determination can be by way of combinatorial logic only, such as by simple logic functions as AND/OR/NOT etc., so that this can be implemented in a relatively simple electrical circuit, or hardware, which can be both inherently more reliable than software, and it also acts as a reliable and safe "back up" to the software - particularly where the additional guard signals are always given precedence over any or all guard signals generated by the processor,

There may be a plurality of interconnected control circuits, each control circuit being located between the processor and a control switch, and these may be interconnected to prevent simultaneous operation of mutually exclusive control switches, In such an arrangement, the combined interconnected control circuits may also contain the logic circuit, or the logic circuit may be located separately and distanced from the control switches. The additional guard signals may be specific to a particular control switch, or they may be common to all control switches, When used in electrical switchgear applications, the invention is appropriate for use at any voltage, such as at low voltage (i.e. below IkV), medium voltage, or high voltage.

BRIEF DESCRIPTION OF THE DRAWINGS

An embodiment of the present invention will now be described by way of example, and with reference to the accompanying figures, in which;

Figure 1 is a schematic diagram of a prior art switchgear control system, and

Figure 2 is a schematic diagram of a system in accordance with the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

Figure 1 shows a conventional switchgear control system 2 in which there are two separate subsets 4, 6, which are indicative of their contents being related to an easily separable transformer or piece of controlled equipment or plant, and/or of their being located in separate housings or locations. A master processor M commands the microcontrollers u to operate the individual control switches c, and guard input signals g to the micro-controllers u or master processor M can be used to inhibit the operation of the controls, entirely under software control. The prevention of unsafe or simultaneous control operation is also entirely under software control.

In the present invention, as shown in Figure 2, the control system 22 shown again has two subsets, 24, 26, and there are now additional hardware elements L between the micro-controllers u and the individual control switches c. These hardware elements L are interconnected (as shown by reference i, in subsets corresponding to different pieces of controlled equipment, though they could be interconnected in any manner appropriate to the particular system). The hardware elements comprise a combinatorial logic circuit (not shown) for the operation of each control c, so that when this logic circuit generates a common guard signal g _c all of the control switches are inhibited from operating, or when a unit specific guard signal g _u is generated the particular unit or units specified is/are inhibited from operating. The effect of the additional hardware interlocks is that the responsibility for safe operation is taken away from the microcontroller and software. Guard signals connected to the master processor (g _m ) can still be distributed via software mechanisms if required, but must not be used for critical inhibits. The combinatorial logic consists only of simple logic functions (AND/OR/NOT etc.) and has no feedback or latch constructs, resulting in a completely deterministic system. As a result, the electronic hardware is significantly more reliable than any possible combination of software elements and eliminates any uncertainty due to present or future software defects or external influences.

EXAMPLE

A common example is where there are "open" and "close" controls (e.g. for operation of a door or gate, or of electrical switchgear). In switchgear applications, the "open" control opens a switch and the "close" control closes a switch. The "programme" for operation of the system stipulates that controls are not to operate "open" and "close" at the same time ("mutually exclusive control"), because this may produce unpredictable results, and/or it may cause physical damage. Other than "open" and "close" examples include "Heat" and "cool" for climate control, and "Run" and "stop" for a conveyor system. A "system healthy" signal indicates that the system is running normally. It can be generated by a separate "health monitor" or "watchdog" device that detects when system operation deviates from normality. The programme operating the system stipulates that unless the system is healthy, no controls should be operated, and that in the following modes of operation: · Off - no control can be operated

* Local - only local commands cause controls to operate

* Remote - only remote commands cause controls to operate no controls should be operated unless the system mode is local or remote, in this example, the combinatorial logic would be to allow operation of a control if: (mutually exclusive control is not operating)

AND

( (mode is Local) OR (mode is Remote) ) AND

(system is healthy). It will of course be understood that many variations may be made to the above- described embodiment without departing from the scope of the present invention. For example, the invention has been described with respect to an electrical switchgear system, however principles of the invention could be applied to any systems which control and monitor equipment/plant at a distance from the operator. The system may operate either by reacting to actuation inputs made by the processor or by an operator (remotely or locally), or by generating guard signals in advance of any proposed movement or input movement instruction. Where different variations or alternative arrangements are described above, it should be understood that embodiments of the invention may incorporate such variations and/or alternatives in any suitable combination.