Standby system passive control transfer system and method

Abstract

This invention discloses a passive control transfer system and method for a standby system, comprising: two parallel signal paths; wherein, the digital signal output of the control program in the main system, the normally closed relay of the main system, and the normally open relay of the standby system are connected in series to form one signal path, and the digital signal output of the control program in the main system is connected in series with the normally open relay of the main system to form another signal path. The digital signal output of the control program controls the opening and closing of the relays, thereby controlling the program transfer. The control transfer between the two systems is achieved through interlocking logic, which can realize the passive control transfer of the entire control program of the standby system, as well as the passive control transfer of a portion of the control program of the standby system, thereby ensuring coordinated operation between the dual redundant systems, achieving stable control, and optimizing the control quality of the unit.

Description

Technical Field

[0001] This invention relates to the field of nuclear power plant control technology, and in particular to a passive control transfer system and method for a backup system. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Currently, the control transfer method used in nuclear power plants mostly adopts a dedicated arbitration unit, and the control transfer between the main control system and the backup control system of the nuclear power plant is achieved through a redundant arbitration module; however, the problems with this control transfer method are: (1) the separate redundant arbitration module is prone to failure and has low reliability; (2) once a fault occurs, the entire system is transferred, and it is impossible to achieve passive control transfer of some functions. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a passive control transfer system and method for a backup system. The control transfer between the two systems is achieved through interlocking logic. This system can realize the passive control transfer of the entire control program of the nuclear power plant's backup system, as well as the passive control transfer of a portion of the backup system's control program. This ensures coordinated operation between the dual redundant systems, achieves stable control, and optimizes the control quality of the unit.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides a passive control transfer system for a backup system, comprising: two parallel signal paths; wherein, the digital signal output of the control program in the main system of the nuclear power plant, the normally closed relay of the main system of the nuclear power plant, and the normally open relay of the backup system of the nuclear power plant are connected in series to form one signal path, and the digital signal output of the control program in the main system of the nuclear power plant and the normally open relay of the main system of the nuclear power plant are connected in series to form one signal path, and the opening and closing of the relay is controlled by the digital signal output of the control program, thereby controlling the program transfer.

[0007] As an alternative implementation, the control programs in the main system of a nuclear power plant include: reactor monitoring (RRS), reactor full-speed power reduction (STB), unit power regulation (UPR), moderator temperature control (MTC), steam generator pressure control (SGP), evaporator level control (SGL), heat transfer control (HTC), and turbine throttle and hydraulic transmission control (HTT).

[0008] As an alternative implementation, the wiring type of the nuclear reactor full-speed power drop control STB program is that the digital signal output of the control program in the main system of the nuclear power plant on both sides is connected in series with the normally open relay of the main system of the nuclear power plant, and then connected in parallel on both sides for simultaneous control.

[0009] As an alternative implementation method, the control programs are independent of each other but share a power supply.

[0010] As an alternative implementation, two digital signal outputs with the same control program are connected in series. After being connected in series, they are connected in series with the normally closed relay of the main system of the nuclear power plant and the normally open relay of the backup system of the nuclear power plant to form one signal path, and connected in series with the normally open relay of the main system of the nuclear power plant to form another signal path.

[0011] As an alternative implementation, the transfer system also includes a wiring method for analog signal output, specifically: the analog signal output of the nuclear power plant main system is connected in series with two normally open relays on the same side, and forms a circuit with the analog input signal of the field control device; the analog signal output of the nuclear power plant standby system is connected in series with a normally open relay on its own side and a normally open relay of the nuclear power plant main system to form a circuit; the normally open relays of the field control device and the nuclear power plant standby system are connected in parallel through two normally closed relays of the nuclear power plant main system.

[0012] As an alternative implementation method, in the wiring method of analog signal output, each analog signal output corresponds to one analog signal input.

[0013] As an alternative implementation, the triggering of the transfer can be controlled by setting trigger conditions.

[0014] As an alternative implementation method, the triggering conditions include: WDT timeout failure, DAISY CHAIN ​​disconnection and power failure, and failure of all or part of the control program.

[0015] Secondly, the present invention provides a transfer method for the above-mentioned backup system passive control transfer system, comprising:

[0016] When the control program in the main system of the nuclear power plant is normal, the main system sends digital output signals to control the execution equipment, and the control program in the backup system of the nuclear power plant is isolated. When at least one control program in the main system of the nuclear power plant fails, the digital signal output corresponding to the failed control program is forcibly disconnected, the corresponding relay is de-energized, and the backup control program in the backup system of the nuclear power plant is started to complete the control transfer.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0018] This invention eliminates the need for a separate redundant arbitration module, using only relays to achieve control transfer, resulting in higher reliability.

[0019] The present invention enables control transfer between the main system and the backup system of a nuclear power plant through interlocking logic. This can achieve passive control transfer of the entire control program of the backup system, as well as passive control transfer of a portion of the backup system's control program, thereby ensuring coordinated operation between the dual redundant systems, achieving stable control, and optimizing the control quality of the unit.

[0020] The eight control programs of this invention are independent of each other. Also, because the eight control programs are independent of each other, the transfer of some programs can be realized, and the transfer of a single program does not affect the operation of other programs.

[0021] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0022] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0023] Figure 1(a)-1(b) The diagram shown is a schematic diagram of parallel access of digital input signals (DI) and analog input signals (AI) provided in Embodiment 1 of the present invention;

[0024] Figure 2 The diagram shown is a power supply diagram for the control program provided in Embodiment 1 of the present invention;

[0025] Figures 3(a)-3(c) The diagram shown is a wiring diagram of the DO control signal provided in Embodiment 1 of the present invention;

[0026] Figure 4 The diagram shown is the AO control signal wiring diagram provided in Embodiment 1 of the present invention. Detailed implementation method:

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0028] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0029] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments of the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. Furthermore, it should be understood that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0031] Example 1

[0032] This embodiment provides a passive control transfer system for a nuclear power plant backup system, including: two parallel signal paths; wherein, the digital signal output of the control program in the main system of the nuclear power plant, the normally closed relay of the main system of the nuclear power plant, and the normally open relay of the backup system of the nuclear power plant are connected in series to form one signal path, and the digital signal output of the control program in the main system of the nuclear power plant and the normally open relay of the main system of the nuclear power plant are connected in series to form another signal path, and the opening and closing of the relay is controlled by the digital signal output of the control program, thereby controlling the program transfer.

[0033] In a dual-redundant control system, to achieve smooth control transfer during operation, the hot standby unit must operate in unison with the main controller. This requires the input signals of the hot standby unit to be consistent with those of the main controller, and both must share input signals from field devices. Therefore, digital (DI) and analog (AI) input signals from the field devices are connected in parallel to both the main controller and the hot standby unit, providing the control program with the basis for control. This is a necessary condition for control transfer in a dual-redundant system. Figure 1(a)-1(b) As shown.

[0034] The control transfer of the dual-redundant control system involves eight main periodically operating control procedures: RRS (Reactor Regulation), STB (Step Back), UPR (Unit Power Regulation Control), MTC (Moderator Temperature Control), SGP (Steam Generator Pressure Control), SGL (Steam Generator Level Control), HTC (Heat Transport Control), and HTT (Hydraulics, Turbine Throttle Control).

[0035] Each control program has four digital output signals DO used to control the transfer interlock. These digital output signals DO are controlled by the control program itself.

[0036] like Figure 2 The diagram shows the power supply for eight control programs. Each of the eight control programs is independent and shares only a 48V power supply. They are not connected to each other. Because the eight control programs are independent, this embodiment can achieve partial transfer. If one program fails, only that program is transferred, without affecting the continued operation of other programs.

[0037] In particular, in this embodiment, since the STB program is quite important, if the program cannot run normally, the other 7 programs will not be able to run. Therefore, the three normally open relays of the STB circuit are connected in series to the rear power supply circuit. If the relays cannot be closed normally, the subsequent programs will not be able to be powered on and run. Otherwise, they are independent of each other.

[0038] When a certain control program is running, DO closes, the corresponding relay coil is energized, the normally open contact (opens when de-energized) closes, and the normally closed contact (closes when de-energized) opens. At this time, the control signals (AO and DO) of the main controller are sent to the field equipment to execute the control function, while the control signals of the hot standby unit are isolated. Only when the main controller fails as a whole or part of the control program fails, the DO corresponding to the failed program is forcibly disconnected by the program EXTC in the main controller, the relay is de-energized, and the control signal of the failed part of the main controller is replaced by the control signal of the hot standby unit and sent to the field. At this time, control transfer occurs.

[0039] Most control programs use the wiring structure shown in Figures 3(a) and 3(b), i.e. master-slave structure, except for STB. This is because its importance requires that both the master controller and the hot standby machine can be controlled in real time, and the field equipment is only allowed to operate when the programs in both the master controller and the hot standby machine are triggered. Therefore, the wiring structure shown in Figure 3(c), i.e. parallel structure wiring, is used.

[0040] Specifically, as shown in Figure 3(a), this wiring type is a single DO output. The wiring method is to connect the normally closed relay contact B on the main controller side, the normally open relay contact C on the hot standby side, and the digital signal output DO in series as one path; the digital signal output DO on the main controller side is connected in series with the normally open relay contact A on this side as one path, and the above two signals are connected in parallel.

[0041] As shown in Figure 3(b), this wiring type is a dual DO output, with two digital signal outputs DO connected in series in the same control program. Other connection methods are the same as in Figure 3(a).

[0042] As shown in Figure 3(c), this wiring type consists of a single DO connected in series with a normally open relay on both sides, and then connected in parallel on both sides for simultaneous control. The field equipment will only lose control and there will be no control transfer when all of them fail.

[0043] All AO control signals are adopted Figure 4 The wiring method in the system is such that each AO corresponds to one AI, which is used for AO feedback to the control program for processing, thereby improving control accuracy;

[0044] Specifically, the AO channel on the main controller side is connected in series with two normally open relays on the same side, forming a loop with the AI ​​of the field control device;

[0045] A normally open relay on the hot standby side and a normally open relay on the main controller side form a circuit;

[0046] The normally open relays on the field control device and the hot standby machine side are connected in parallel through normally closed relays on the two main controller sides.

[0047] In this embodiment, control transfer occurs only in the event of a complete failure of the main controller or a partial failure of the control program. The triggering logic for control transfer is controlled by the DAISY CHAIN, where the WDT (Watchdog Timer) of the main controller system resides. This embodiment provides five triggering conditions for control transfer, namely:

[0048] 1) WDT timeout expired

[0049] The main controller system of the nuclear power plant is equipped with two WDT boards. Their working principle is as follows: a 555 timer with a set time of 2 seconds is used to control the relay coil. When the timer is running normally, the relay coil is energized. When the timer stops, the relay coil is de-energized.

[0050] The corresponding contact of the relay is Figure 2 The normally open contact between "1" and "2" in the circuit. During normal operation, the EXTC program resets the WDT every 0.5 seconds to prevent the WDT from stopping. If the WDT is not reset after 2 seconds due to a main controller hardware failure or other reasons, the WDT will time out and fail, opening the contacts and causing relays RL-1 and RL-2 to lose power. Figure 2 All control program branches on the right lose power, and the interlocking logic automatically isolates the failure of the main controller, resulting in a transfer of overall control of the dual-redundant system.

[0051] 2) The Watchdog's "NORMAL / OVERRIDE" knob should be pointing to the "OVERRIDE" position.

[0052] When the Watchdog's "NORMAL / OVERRIDE" knob is in the "OVERRIDE" position, Figure 2 If the relay RL-3 coil in the middle loses power, it will also cause all the control programs on the right to lose power, resulting in a transfer of overall control of the dual-redundant system.

[0053] 3) All or part of the control program fails.

[0054] When all or part of the control program in DCCX fails, its CHK program will call the EXTC program module to forcibly disconnect the DO of the failed program, causing the corresponding relay coil to lose power. Figures 3(a)-3(c) and Figure 4 It can be seen that at this time, the failure control program on DCCX will transfer the control function to DCCY, and the corresponding control program on DCCY will complete the corresponding control function. At this time, the DCC system is experiencing a partial control transfer.

[0055] 4) DAISY CHAIN ​​disconnected

[0056] When the DAISY CHAIN ​​of the DCC system is disconnected due to some reason (such as a disconnection in wiring), the relays on all DO boards will not be energized. At this time, all DOs are disconnected, and AO is also disconnected due to the control of the relay contacts. If this happens on DCCX, then the overall control transfer will occur.

[0057] 5) DAISY CHAIN ​​loses power

[0058] The power supply for the DAISY CHAIN ​​comes from the CDR rack. If the power supply to the DAISY CHAIN ​​is lost for some reason (such as a disconnection), the consequences are the same as if it were disconnected. If this happens on the DCCX, then the overall control transfer of the DCC system will occur.

[0059] Example 2

[0060] This embodiment provides a transfer method for the above-mentioned backup system passive control transfer system, including:

[0061] When the control program in the main system of the nuclear power plant is normal, the main system sends digital output signals to control the execution equipment, and the control program in the backup system of the nuclear power plant is isolated. When at least one control program in the main system of the nuclear power plant fails, the digital signal output corresponding to the failed control program is forcibly disconnected, the corresponding relay is de-energized, and the backup control program in the backup system of the nuclear power plant is started to complete the control transfer.

[0062] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A standby system passive control switchover system, characterized by, The application relates to a nuclear power station control system transfer system. The main system control program comprises a reactor regulatory system (RRS), a nuclear reactor full speed drop power control system (STB), a unit power regulation control system (UPR), a moderator temperature control system (MTC), a steam generator pressure control system (SGP), a evaporator liquid level control system (SGL), a heat transport control system (HTC) and a turbine oil gate and hydraulic transmission control system (HTT), and the control programs are independent and share a power supply. Two digital signal outputs of the control program are connected in series, and the series connection is connected with a normally closed relay of the main system and a normally open relay of the standby system to form a signal path and is connected with a normally open relay of the main system to form another signal path. The trigger condition comprises a watchdog timer (WDT) timeout failure, a DAISY CHAIN disconnection and power-off or all or part of the control program failure. The wiring type of the nuclear reactor full speed drop power control system (STB) program is that the digital signal output of the main system control program is connected with the normally open relay of the main system in series, and the two sides are connected in parallel and controlled simultaneously.

2. A passive control transfer system for a backup system as claimed in claim 1, wherein, In the transfer system, the wiring mode of the analog signal output is that the analog signal output of the main system is connected with two normally open relays on the same side in series and forms a loop with the analog input signal of the field control device; the analog signal output of the standby system is connected with one normally open relay on the same side and one normally open relay of the main system to form a loop; and the normally open relay of the standby system is connected with the two normally closed relays of the main system in parallel.

3. A passive control transfer system for a backup system as recited in claim 1, wherein, In the wiring mode of the analog signal output, each analog signal output corresponds to one analog signal input.

4. A passive control transfer system for a backup system as claimed in claim 3, wherein, When the main system control program of the nuclear power station is normal, the digital output signal is sent by the main system of the nuclear power station to control the execution equipment, and the control program of the standby system of the nuclear power station is isolated; 5. A method of transferring a passive control transfer system according to any one of claims 1-4, characterized in that When at least one control program of the main system of the nuclear power station fails, the digital output signal corresponding to the failed control program is forcibly disconnected, the corresponding relay is powered off, the standby control program of the standby system of the nuclear power station is started, and the control transfer is completed. ​ ​

Images