A method for optimizing the alarm burden of digital instrumentation and control platform in nuclear power plants

Abstract

The purpose of the present invention is to provide a method for optimizing the alarm burden of a digital instrumentation and control platform of a nuclear power plant, comprising the following steps: step S01, determining whether it is a transient operating condition or an overhaul operating condition, if it is a transient operating condition, proceeding to step S04, if it is an overhaul operating condition, proceeding to step S02; step S02, when a function in a dedicated safety facility is locked and a lockout effectiveness signal B is generated, the original suppression condition for suppressing the generation of the alarm is subjected to a "logical OR" process with the lockout condition corresponding to the function to obtain a new suppression condition; step S03, eliminating the alarm signal corresponding to the new suppression condition; step S04, screening the alarm signals that are bound to appear, screening out the initial alarm and the unnecessary secondary alarms caused by each initial alarm; step S05, so that when a certain initial alarm appears, its corresponding secondary alarm is suppressed and does not appear in the alarm list that the operator needs to handle.

Description

Technical Field

[0001] The invention relates to a nuclear power plant alarm system of a digital instrumentation and control platform, and in particular to an alarm burden optimization method for a nuclear power plant digital instrumentation and control platform. Background Art

[0002] The digital instrumentation and control platform nuclear power plant alarm system is an important part of the nuclear power plant. The safe, reliable and economical operation of the reactor depends to a large extent on the performance level of the instrumentation and control system. Under the overhaul condition of the nuclear power plant, the unit status changes quickly, the system equipment status changes greatly, and key parameters such as temperature, pressure and water level change in a short time. The digital instrumentation and control platform nuclear power plant alarm system will generate a large number of alarms, especially after a large number of equipment are shut down and isolated, the alarms are more redundant. A large number of useless alarms will affect the effectiveness of information presentation, so that the truly important abnormal conditions or status changes that need to be paid attention to in time are buried in the sea of ​​alarms. Operators need to identify a few useful information among hundreds of useless alarms. Under the already complex working conditions of the nuclear power plant overhaul itself, the difficulty of operator monitoring and control is further increased. At the same time, due to the requirements of alarm response, the burden of useless alarms will also affect the activities and efficiency of operators, resulting in operators often being unable to monitor in time due to too many alarms, thereby causing equipment protection actions or affecting the equipment startup process.

[0003] The Chinese patent document with publication number CN101339817B discloses an alarm suppression method for a digital alarm system of a nuclear power plant, which confirms the functional validity of the alarm signal generated in the alarm system; when the alarm signal is invalid, the alarm signal is prohibited from triggering an alarm, otherwise, it is determined whether the alarm signal needs to be paid attention to according to the current operating conditions or by checking whether there are other signals that suppress the alarm signal. If it does not need to be paid attention to, the alarm signal is subjected to alarm suppression processing and the corresponding alarm indicator is not triggered. The invention determines whether the alarm signal needs to be suppressed after confirming the validity of the alarm signal, so as not to trigger the alarm. However, the invention has the following defects: sometimes a large number of alarms are generated simultaneously in a nuclear power plant, such as a large number of alarms during expected transient conditions such as emergency shutdown of the reactor and emergency shutdown of the steam turbine generator set, and during overhaul conditions, it is difficult for the staff to confirm the alarm information one by one, which is inefficient and easy to miss valid information. Summary of the invention

[0004] The purpose of the present invention is to provide a method for optimizing the alarm burden of a digital instrumentation and control platform of a nuclear power plant, which is used to effectively reduce unnecessary alarms under expected transient conditions such as emergency shutdown of a nuclear power plant reactor and emergency shutdown of a steam turbine generator set, as well as under overhaul conditions, reduce the number of alarms, and alleviate the alarm burden problem of the nuclear power unit alarm system under expected transient conditions such as emergency shutdown of a nuclear power plant reactor and emergency shutdown of a steam turbine generator set, as well as under overhaul conditions.

[0005] The above technical objectives of the present invention are achieved through the following technical solutions:

[0006] A method for optimizing the alarm burden of a digital instrumentation and control platform of a nuclear power plant comprises the following steps: step S01, a working condition judgment step: judging whether it is a transient working condition or an overhaul working condition, if it is a transient working condition, entering step S04, if it is an overhaul working condition, entering step S02; step S02, a new suppression condition acquisition step: when a function in a dedicated safety facility is locked and a lockout effective signal B is generated, the original suppression condition T used to suppress the generation of the alarm is obtained. 1 The blocking condition T corresponding to this function 2 Perform "logical or" processing to obtain the new suppression condition T 3 ; Step S03, alarm signal D 1 Suppression step: Set the new suppression condition T 3 The corresponding alarm signal D 1 Eliminate; Step S04, initiate alarm D 2 'With secondary alarm D 2 Screening step: for the alarm signal D that will inevitably appear 2 Screen and select the originating alarm D 2 ' and each originating alarm D 2 'Caused, unnecessary secondary alarm D 2 "; Step S05, secondary alarm D 2 "Suppression step: through configuration, when a certain initial alarm D 2 'After it appears, the corresponding secondary alarm D 2 " is suppressed and does not appear in the list of alarms that the operator needs to handle.

[0007] Therefore, transient conditions refer to emergency conditions that occur in transient conditions, such as emergency shutdown of reactors and emergency shutdown of steam turbine generator sets, and overhaul conditions refer to normal maintenance and refueling conditions of nuclear power plants within a certain period. Both conditions will generate a large number of alarms, many of which are invalid alarms. There are differences in alarm signals under different conditions, so it is necessary to first determine what condition it is.

[0008] Step S01 is used to determine the working condition, which can be determined manually or by setting a corresponding function on the instrumentation and control equipment.

[0009] When it is an overhaul condition, enter step S02:

[0010] The original suppression condition T was originally set in the alarm system of the digital instrumentation and control platform to suppress the generation of alarm signals and thus reduce the number of alarms. 1 , original inhibition condition T 1 Triggered by a specific signal. Original inhibition condition T 1After triggering, when parameters such as temperature, water level or pressure change, some of the original inhibition conditions T 1 The suppressed alarm signal is not generated, thus reducing the number of alarms. However, many alarms are generated under overhaul conditions, and the original suppression condition T 1 The number of suppressed alarm signals is still limited.

[0011] Dedicated safety facilities refer to: a general term for various safety systems that are specially set up when a nuclear power plant is put into use and performs safety functions under accident conditions to control the consequences of the accident and enable the reactor to reach a stable and acceptable state after the accident. They include safety injection systems, containment spray systems, auxiliary water supply systems, etc. Under normal conditions, after the key parameters change, the protection function of the corresponding system of the dedicated safety facility will perform a protective action. However, the overhaul condition of the nuclear power plant is not an accident, but a normal maintenance. Therefore, the protection function of each system of the dedicated safety facility does not need to perform a protective action. In the prior art, in order to prevent the safety system of the dedicated safety facility from performing a protective action, it is necessary to perform a functional lock on each safety system. Before the function is locked, the key parameters corresponding to each safety system (such as temperature, water level, pressure, etc.) need to meet the corresponding lock conditions T 2 , different safety systems have multiple corresponding locking conditions T 2 different.

[0012] Locking condition T of safety system function 2 and original inhibitory condition T 1 Similar: when key parameters such as temperature, pressure or water level reach a certain value, then inhibit the realization of certain functions. The difference is that for the same key parameters, the locking condition T 2 Compared with the original inhibitory condition T 1 Easier to trigger and with a wider trigger range. In addition, since the dedicated safety facilities contain multiple safety systems, the functional locking conditions of different safety systems are 2 Different, each locking condition T 2 It is also necessary to combine a variety of different types of key parameters, so the locking condition T 2 More applicable parameter types.

[0013] In general, the locking condition T 2 The number of parameter types involved is much larger than the original suppression condition T 1 , and the range is larger. If the locking condition can be combined with the original inhibition condition T 1 By superimposing them, a larger alarm suppression range can be obtained.

[0014] Based on the above principle, in order to increase the number of suppressed alarm signals, in step S02, the locking condition T 2 With the original inhibition condition T 1 Perform "logical OR" processing to obtain a new suppression condition T with a wider range3 After a safety system function in a dedicated safety facility is locked, the corresponding locking condition T 2 With the original inhibition condition T 1 Perform "logical or" processing to obtain the new suppression condition T 3 . New inhibition condition T 3 The range is greater than the original inhibition condition T 1 , thus suppressing the generation of more alarm signals. The specific implementation principle is as follows:

[0015] In the prior art, a function in a dedicated safety facility satisfies the corresponding locking condition T 2 After successful locking, a locking effective signal B will be generated. The locking effective signal B only serves as a reminder in the original design. However, in this case, the following logic is designed using the locking effective signal B: After the locking effective signal B appears, the locking condition T corresponding to the locked function in the dedicated safety facility 2 With the original inhibition condition T 1 Perform "logical OR" processing to obtain a new suppression condition T with a larger number of suppression alarm signals. 3 .

[0016] Get the new inhibition condition T 3 Then, enter step S03 to set the new suppression condition T 3 The corresponding alarm signal D 1 Eliminate. New inhibition condition T 3 It is triggered by the blocking effective signal B. After being triggered, the corresponding alarm signal D 1 Suppression is performed, thereby reducing the number of alarms under overhaul conditions.

[0017] Under the overhaul condition, after step S03 is finished, some alarm signals are still not suppressed, and in order to suppress more alarm signals, step S04 is entered. Under the transient condition, step S01 directly enters step S04.

[0018] Step S04: a type of alarm signal D that must appear 2 Filter out the initial alarm D 2 'With secondary alarm D 2 ". Alarm signal D 2 Refers to the general term for alarm signals that are bound to appear under overhaul conditions and transient conditions. 2 ' is the first alarm, the initial alarm D 2 'After it appears, it will cause a series of secondary alarms D 2 " is generated, and the subsequent alarm D 2 " is an unnecessary alarm, and the operator does not need to confirm it. Therefore, the secondary alarm D 2"Suppression processing is performed to reduce the number of alarm signals that operators need to deal with. The initial alarm D 2 'With secondary alarm D 2 The screening criteria are based on the analysis of the real alarm data during the operation of the unit. 2 'With secondary alarm D 2 "It is necessary to verify it on the simulator and the actual unit to ensure that the secondary alarms that do not affect safety after suppression are screened out. 2 ”.

[0019] In the prior art, the initial alarm D 2 'For multiple, single originating alarm D 2 'Corresponding to multiple secondary alarms D 2 ", in step S05, establish each initial alarm D 2 'The corresponding multiple secondary alarms D 2 "The configuration relationship between them makes an initial alarm D 2 'After it appears, the corresponding multiple secondary alarms D 2 " can be suppressed and does not appear in the alarm list that the operator needs to deal with, thereby reducing the number of alarm signals that the operator needs to confirm.

[0020] Under overhaul conditions, alarm signal D 1 The number and alarm signal D 2 The sum of the alarm signals is basically the sum of the alarm signals, and the alarm signal D 2 Most of them are secondary alarms D 2 After the above steps, the alarm signal D is suppressed. 1 With secondary alarm D 2 ". In transient conditions, the secondary alarm D 2 ” is the sum of most invalid alarms. It can be seen that by suppressing these two types of signals, the number of alarm signals under overhaul conditions and transient conditions is greatly reduced.

[0021] As a preferred embodiment of the present invention, in the step S05, under the overhaul condition, the first operation stage is included: when the pressurizer pressure drops, the corresponding dedicated safety facility generates a function lock signal, and the secondary alarm D corresponding to the initial alarm with the pressurizer pressure low automatic shutdown setting value as the alarm triggering condition is turned off. 2 "hide.

[0022] Therefore, under overhaul conditions, the secondary alarm D 2 "It will be suppressed only when certain conditions are met, i.e. the alarm is triggered. 2'After it appears. The specific operation time of the first operation stage is: at the beginning of the overhaul condition (within about 12 hours), the pressure, temperature and other parameters of the reactor circuit will change first, and the pressurizer will perform voltage stabilization. However, due to the overhaul condition, the pressurizer does not need to be processed, so it needs to be locked. The lockout signal that appears after the pressurizer is locked can be regarded as a change in the pressure parameters in the reactor. After the change, a large number of alarms will appear, which is equivalent to an alarm prompt signal. Therefore, the operator judges when the corresponding initial alarm appears according to the time when this signal appears, and the corresponding secondary alarm D 2 " to suppress.

[0023] Specifically, after the pressurizer of the safety system of the dedicated safety facility drops, a P-11 signal (pressurizer low pressure allowable lockout signal), i.e., a lockout signal, will appear in the safety system corresponding to the dedicated safety facility. After the lockout signal appears, the operator will suppress the secondary alarm corresponding to the initial signal PMSA-PPLO-BT (protection and safety monitoring system A sequence pressurizer low pressure 3 shutdown function partial triggering) that was originally triggered after reaching the pressurizer low pressure automatic shutdown setting value in advance, to prevent the secondary alarm related to the initial alarm from occurring.

[0024] As a preferred embodiment of the present invention, in step S05, after the first operation stage, a second operation stage is further included: selecting the power failure alarm of the smoke exhaust fan A as the initial alarm D of the second stage 2 ', and its corresponding secondary alarm D 2 "hide.

[0025] Thus, the secondary alarm D suppressed in the second stage (about 12-36 hours after the start of the overhaul) 2 ", mainly appears after power failure and isolation. After power failure and isolation, the secondary circuit stops operating, vacuum pumping, shaft seal, turning gear, hydrogen sealing oil system and other systems and equipment stop operating, and alarm signals such as low shaft seal pressure, low condenser vacuum pressure tripping, and low lubricating oil pressure tripping appear one after another. These secondary alarms caused by changes in parameters such as pressure D 2 "The suppression has been achieved in the first stage. According to the normal shutdown procedures, after destroying the vacuum and shutting down the shaft seal, the hydrogen sealing oil and AC lubricating oil pumps are shut down, and finally the main oil tank exhaust fan is shut down. Therefore, the second stage mainly suppresses the alarm caused by the main oil tank exhaust fan.

[0026] As a preferred embodiment of the present invention, in step S05, when the initial alarm D 2 'After it appears, the corresponding secondary alarm D 2 ” to a specific alarm display list to suppress alarms.

[0027] Therefore, when the initial alarm D 2'After it appears, the corresponding secondary alarm D 2 "Configure to a specific alarm display list to suppress alarms. Specifically, in this case, establish the initial alarm D 2 'With secondary alarm D 2 "The control relationship between them, the initial alarm D 2 'After it appears, only one initial alarm D 2 'Processing can process all subsequent alarms D in one step 2 ” is configured to the specific alarm display list. The specific alarm display list is the existing technology, and the secondary alarm D 2 "After entering the list, it is hidden and will not appear in the alarm list that the operator needs to handle, reducing the number of alarms received by the operator.

[0028] As a preferred embodiment of the present invention, after step S05, the following steps are further included: step S06, a subsequent alarm D 2 "Unsuppression step: Remove the subsequent alarm D placed in the specific alarm display list 2 ”.

[0029] Therefore, after step S05, step S06 is further included to remove the subsequent alarm D placed in the specific alarm display list. 2 ". Due to the different conditions of each overhaul and transient condition, it cannot be guaranteed that the same secondary alarm needs to be suppressed each time. 2 Therefore, in this embodiment, after each overhaul condition or transient condition ends, it is necessary to remove the secondary alarm D in the specific alarm display list. 2 ", next time, select the appropriate secondary alarm D according to the actual situation 2 ”.

[0030] As a preferred embodiment of the present invention, in step S02, after the shutdown signal R and the locking effective signal B appear, both trigger the suppression alarm signal C; when the shutdown signal R appears, the suppression alarm signal C triggers the original suppression condition T 1 When the blocking effective signal B appears, the suppression alarm signal C triggers the new suppression condition T 3 .

[0031] Therefore, due to the original inhibition condition T 1 It is triggered by the shutdown signal R, which refers to the signal that appears when the reactor is shut down. This signal will appear in a nuclear power plant under transient conditions. The new suppression condition T 3It only appears in the overhaul condition and is triggered by the lockout effective signal B. To ensure safety, the trigger conditions corresponding to the transient condition and the overhaul condition must be retained. Therefore, the following logic is added: When one of the shutdown signal R and the lockout effective signal B appears, a suppression signal C will be triggered. The suppression signal C is used to trigger the original suppression condition T 1 Or new inhibition condition T 3 However, when the shutdown signal R appears, the suppression signal C triggers the original suppression condition T 1 When the blocking effective signal B appears, the suppression alarm signal C triggers the new suppression condition T 3 .

[0032] As a preferred embodiment of the present invention, in step S04, the secondary alarm D 2 "One of the following conditions must be met: an alarm that will definitely be triggered according to the instrumentation and control logic or protection logic after a shutdown, an alarm that will be checked in the response procedure after a shutdown, or an alarm that will definitely be triggered by the system dynamic response after a shutdown.

[0033] Therefore, when classifying alarm signals, if the signal is to be defined as a secondary alarm D 2 ", except for the clear originating alarm D 2 In addition to the alarm, one of the following conditions must be met: an alarm that will definitely appear according to the instrumentation and control logic or protection logic after the shutdown, an alarm that will be checked in the response procedure after the shutdown, or an alarm that will definitely appear after the system dynamic response after the shutdown. The above conditions are essentially to help the operator confirm and judge in advance the part of the alarm that will definitely appear. The alarm signal that meets the above conditions is an unimportant alarm and does not need to be processed.

[0034] As a preferred embodiment of the present invention, in step S05, the secondary alarm D added to the specific alarm display list 2 ” is displayed in the display column where the operator does not need to confirm.

[0035] As a result, the secondary alarm D that was suppressed and did not occur 2 "There may be alarm signals that the operator needs to check, so the secondary alarm D 2 " completely disappears or cannot appear. In this case, the operator can still view the secondary alarm D in the corresponding display column 2 ", and track the accident in the later stage. The display bar is an existing technology, which is used to display the alarm signal. The operator does not need to confirm the alarm signal in the display bar, but can view it. 2 "Suppression means: making the subsequent alarm D 2 ” does not appear in the alarm bar where the operator needs to confirm the processing of the alarm signal.

[0036] In summary, the present invention has the following beneficial effects:

[0037] 1. Locking condition T 2 With the original inhibition condition T 1 Perform "logical or" processing to obtain the new suppression condition T 3 , new inhibition condition T 3 The range is greater than the original inhibition condition T 1 , can suppress the corresponding alarm signal D 1 , suppressing more alarm signals.

[0038] 2. Filtered initial alarm D 2 'With secondary alarm D 2 ", establish the initial alarm D 2 'With secondary alarm D 2 "The control relationship between them, the initial alarm D 2 'After it appears, only one initial alarm D 2 'Processing can process all subsequent alarms D in one step 2 ” is configured to a specific alarm display list and does not appear in the alarm list that the operator needs to handle, reducing the number of alarms received by the operator.

[0039] 3. After the P-11 signal (pressurizer low pressure allowable lockout signal) appears, the operator shall put the secondary alarm corresponding to the initial signal PMSA-PPLO-BT (protection and safety monitoring system A sequence pressurizer low pressure 3 shutdown function partial triggering) into the specific alarm display list in advance to prevent the generation of secondary signals related to the initial signal.

[0040] 4. Select the power failure alarm of smoke exhaust fan A as the initial alarm of the second stage, and hide its corresponding secondary alarm.

[0041] 5. The operator can still view the secondary alarm D in the corresponding display column 2 ” and follow up at a later stage of the incident.

[0042] 6. When one of the shutdown signal R and the lockout effective signal B appears, a suppression signal C will be triggered. The suppression signal C is used to trigger the original suppression condition T. 1 Or new inhibition condition T 3 However, when the shutdown signal R appears, the suppression signal C triggers the original suppression condition T 1 When the blocking effective signal B appears, the suppression alarm signal C triggers the new suppression condition T 3 The trigger conditions corresponding to transient conditions and overhaul conditions are retained to ensure safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic diagram of the process of Example 1. DETAILED DESCRIPTION

[0044] Example 1, the digital instrumentation and control platform alarm system in a nuclear power plant is an important part of the nuclear power plant. The safe, reliable and economical operation of the reactor depends to a large extent on the performance level of the instrumentation and control system. The nuclear power plant will shut down the reactor during expected transient conditions such as emergency shutdown of the reactor and emergency shutdown of the steam turbine generator set, as well as during overhaul conditions. After the shutdown, the key parameters such as temperature, pressure, and water level in each circuit will change significantly with the need for unit state control. When the value of the key parameter changes and reaches the preset alarm value, the digital instrumentation and control platform alarm system will generate a large number of alarms. However, not all alarms are effective alarms. The operator needs to identify useful alarms from hundreds or thousands of alarms. The avalanche of alarms has caused serious interference to the operator and affected the effective presentation of useful information.

[0045] Transient conditions refer to emergency conditions that occur in transient conditions, such as emergency shutdown of reactors and emergency shutdown of steam turbine generator sets. Overhaul conditions refer to normal maintenance and refueling conditions of nuclear power plants within a certain period. Both conditions will generate a large number of alarms, many of which are invalid alarms. The alarm signals under different conditions are different, so it is necessary to first determine what condition it is.

[0046] Step S01 is used to determine the working condition, which can be determined manually or by setting a corresponding function on the instrumentation and control equipment.

[0047] When it is an overhaul condition, enter step S02:

[0048] The original suppression condition T was originally set in the alarm system of the digital instrumentation and control platform to suppress the generation of alarm signals and thus reduce the number of alarms. 1 , original inhibition condition T 1 Triggered by a specific signal. Original inhibition condition T 1 After triggering, when parameters such as temperature, water level or pressure change, some of the original inhibition conditions T 1 The suppressed alarm signal is not generated, thus reducing the number of alarms. However, many alarms are generated in the case of overhaul, and the original suppression condition T 1 The number of suppressed alarm signals is still limited.

[0049] In this embodiment, the following measures are taken to reduce the alarm during the overhaul period:

[0050] Step S02, new suppression condition acquisition step: When the function in the dedicated safety facility is locked and the lockout effective signal B is generated, the original suppression condition T used to suppress the alarm generation is1 The blocking condition T corresponding to this function 2 Perform "logical or" processing to obtain the new suppression condition T 3 .

[0051] Among them, dedicated safety facilities refer to: a general term for various safety systems specially set up when a nuclear power plant is put into use and performs safety functions under accident conditions to control the consequences of the accident and enable the reactor to reach a stable and acceptable state after the accident, including safety injection systems, containment spray systems, auxiliary water supply systems, etc. Under normal operating conditions, after the key parameters change, the protection function of the corresponding system of the dedicated safety facility will perform a protection action, but the overhaul is not an accident, but a normal maintenance, so the protection function of each system of the dedicated safety facility does not need to perform a protection action. In the prior art, in order to prevent the safety system of the dedicated safety facility from performing a protection action, it is necessary to perform a functional lock on each safety system. Before the function is locked, the key parameters corresponding to each safety system (such as temperature, water level, pressure, etc.) need to meet the corresponding lock conditions T 2 , different safety systems have multiple corresponding locking conditions T 2 different.

[0052] Locking condition of safety system T 2 and original inhibitory condition T 1 Similar: when key parameters such as temperature, pressure or water level reach a certain value, then inhibit the realization of certain functions. The difference is that for the same key parameters, the locking condition T 2 Compared with the original inhibitory condition T 1 Easier to trigger and with a wider trigger range. In addition, since the dedicated safety facilities contain multiple safety systems, the functional locking conditions of different safety systems are 2 Different, each locking condition T 2 It is also necessary to combine a variety of different types of key parameters, so the locking condition T 2 More applicable parameter types.

[0053] In general, the locking condition T 2 The number of parameter types involved is much larger than the original suppression condition T 1 , and the range is larger. If the locking condition can be combined with the original inhibition condition T 1 By superimposing them, a larger alarm suppression range can be obtained.

[0054] Based on the above principle, in order to increase the number of suppressed alarm signals, in step S02, the locking condition T 2 With the original inhibition condition T 1 Perform "logical OR" processing to obtain a new suppression condition T with a wider range 3 After a safety system function in a dedicated safety facility is locked, the corresponding locking condition T2 With the original inhibition condition T 1 Perform "logical or" processing to obtain the new suppression condition T 3 . New inhibition condition T 3 The range is greater than the original inhibition condition T 1 , thereby suppressing the generation of more alarm signals.

[0055] New inhibition condition T 3 The specific implementation principle of the generation is as follows: In the prior art, a function in a dedicated safety facility satisfies the corresponding locking condition T 2 After successful locking, a locking effective signal B will be generated. The locking effective signal B only serves as a prompt in the original design. However, in this embodiment, the following logic is designed using the locking effective signal B: After the locking effective signal B appears, the locking condition T corresponding to the locked function in the dedicated safety facility is 2 With the original inhibition condition T 1 Perform "logical OR" processing to obtain a new suppression condition T with a larger number of suppression alarm signals. 3 , thereby reducing the number of alarms.

[0056] Get the new inhibition condition T 3 Then, enter step S03 to set the new suppression condition T 3 The corresponding alarm signal is eliminated. New suppression condition T 3 It is triggered by the locking effective signal B. Once triggered, the corresponding alarm signal is suppressed, thereby reducing the number of alarms.

[0057] Tests conducted during the overhaul of the nuclear power plant show that the above scheme is applicable to at least the drive function lockout of the following dedicated safety facilities: safety injection signals caused by pressurizer pressure low 3, main steam pipe pressure low 2, and main coolant cold section temperature low 2; protection action signals caused by pressurizer water level high 3, high 2, low 2, SG narrow range water level high 3, SG narrow range water level low 2, and wide range water level low 2.

[0058] Under the overhaul condition, after step S03 is finished, some alarm signals are still not suppressed, and in order to suppress more alarm signals, step S04 is entered. Under the transient condition, step S01 directly enters step S04.

[0059] Step S04: a type of alarm signal D that must appear 2 Filter out the initial alarm D 2 'With secondary alarm D 2 ". Alarm signal D 2 Refers to the general term for alarm signals that are bound to appear under overhaul conditions and transient conditions. 2 ' is the first alarm, the initial alarm D 2'After it appears, it will cause a series of secondary alarms D 2 " is generated, and the subsequent alarm D 2 " is an unnecessary alarm, and the operator does not need to confirm it. Therefore, the secondary alarm D 2 "Suppression processing is performed to reduce the number of alarm signals that operators need to deal with. The initial alarm D 2 'With secondary alarm D 2 The screening criteria are based on the analysis of the real alarm data during the operation of the unit. 2 'With secondary alarm D 2 "It is necessary to verify it on the simulator and the actual unit to ensure that the secondary alarms that do not affect safety after suppression are screened out. 2 ”.

[0060] In step S04, the alarm D is issued. 2 "It needs to meet one of the following conditions: it is an alarm that will definitely appear according to the instrumentation and control logic or protection logic after the shutdown, it is an alarm that will be checked in the response procedure after the shutdown, or it is an alarm that will definitely appear after the system dynamic response after the shutdown. The above conditions are essentially to help the operator to confirm and judge in advance which part of the alarms will definitely appear. The alarm signal that meets the above conditions is an unimportant alarm, and is defined as a secondary alarm. 2 ”, no processing is required.

[0061] After the screening is completed, the process proceeds to step S05. In the prior art, the initial alarm D 2 'For multiple, single originating alarm D 2 'Corresponding to multiple secondary alarms D 2 ", in step S05, establish each initial alarm D 2 'The corresponding multiple secondary alarms D 2 "The configuration relationship between them makes an initial alarm D 2 'After it appears, the corresponding multiple secondary alarms D 2 " can be suppressed and does not appear in the alarm list that the operator needs to deal with, thereby reducing the number of alarm signals that the operator needs to confirm.

[0062] Under overhaul conditions, alarm signal D 1 The number and alarm signal D 2 The sum of the alarm signals is basically the sum of the alarm signals, and the alarm signal D 2 Most of them are secondary alarms D 2 After the above steps, the alarm signal D is suppressed. 1 With secondary alarm D 2 ". In transient conditions, the secondary alarm D 2” is the sum of most invalid alarms. It can be seen that by suppressing these two types of signals, the number of alarm signals under overhaul conditions and transient conditions is greatly reduced.

[0063] Specifically, in step S05, when the initial alarm D 2 'After it appears, the corresponding secondary alarm D 2 "Configure to a specific alarm display list to suppress alarms. Specifically, in this case, establish the initial alarm D 2 'With secondary alarm D 2 "The control relationship between them, the initial alarm D 2 'After it appears, only one initial alarm D 2 'Processing can process all subsequent alarms D in one step 2 "Configure to a specific alarm display list. Specifically, in this embodiment, first configure each initial alarm D 2 'The corresponding secondary alarm D 2 ", when the initial alarm D 2 'After it appears, the operator only needs to manually select the originating alarm D 2 ', the corresponding secondary alarm D 2 ” is configured to the specific alarm display list. The specific alarm display list is the existing technology, and the secondary alarm D 2 "After entering the list, it is hidden and will not appear in the alarm list that the operator needs to handle, reducing the number of alarms received by the operator.

[0064] In addition, in step S05, the secondary alarm D that is suppressed and does not appear 2 "There may be alarm signals that the operator needs to check, so the secondary alarm D 2 " completely disappears or cannot appear. In this case, the operator can still view the secondary alarm D in the corresponding display column 2 ", and track the accident in the later stage. The display bar is an existing technology, which is used to display the alarm signal. The operator does not need to confirm the alarm signal that appears in the display bar, but can view it. The display bar is different from the alarm bar. The alarm signal in the alarm bar needs to be confirmed by the operator, but the alarm signal in the display bar does not need to be confirmed by the operator.

[0065] In step S05, the following contents are also included: Under the overhaul condition, the first operation stage is included: when the pressurizer pressure drops, the corresponding dedicated safety facility generates a function lock signal, and the secondary alarm D corresponding to the initial alarm with the pressurizer pressure low automatic shutdown setting value as the alarm triggering condition is turned off. 2 "Hide. After the first operation stage, there is also a second operation stage: select the power failure alarm of the exhaust fan A as the initial alarm of the second stage, and its corresponding secondary alarm D 2"hide.

[0066] During the overhaul operation, different key parameters change at different stages, so different types of initial alarms will appear at different stages. 2 " and secondary alarm D 2 In the first stage, according to the characteristics of temperature and pressure reduction at the beginning of the overhaul condition, the corresponding initial alarm D is selected. 2 ', so that many secondary alarms will inevitably appear in the process of cooling and reducing pressure. 2 ” is automatically placed in the specific alarm display list.

[0067] The specific operation time of the first operation stage is: at the beginning of the overhaul condition (within about 12 hours), the pressure, temperature and other parameters of the reactor circuit will change first, and the pressurizer will perform pressure stabilization. However, due to the overhaul condition, the pressurizer does not need to be processed, so it needs to be locked. The lockout signal that appears after the pressurizer is locked can be regarded as the pressure parameter in the reactor has changed. After the change, a large number of alarms will appear, which is equivalent to an alarm prompt signal. Therefore, the operator determines when to handle the initial alarm based on the time when this signal appears, and puts the corresponding secondary alarm into the specific alarm display list (secondary alarm column).

[0068] Specifically, after the pressurizer of the safety system of the dedicated safety facility drops, a P-11 signal (pressurizer low pressure allowable lockout signal) will appear in the safety system corresponding to the dedicated safety facility, i.e., a lockout signal. After the lockout signal appears, the operator will advance the secondary alarm D corresponding to the initial alarm that was originally triggered after reaching the pressurizer low pressure automatic shutdown setting value. 2 " is put into the specific alarm display list to prevent the subsequent alarms related to the initial alarm. 2 " is generated. Specifically, the initial alarm is PMSA-PPLO-BT (protection and safety monitoring system A sequence pressurizer pressure low 3 shutdown function partial triggering).

[0069] Secondary alarms suppressed during the second phase (approximately 12-36 hours after the start of the overhaul) 2 ", mainly appears after power failure and isolation. After power failure and isolation, the secondary circuit stops operating, vacuum pumping, shaft seal, turning gear, hydrogen sealing oil system and other systems and equipment stop operating, and alarm signals such as low shaft seal pressure, low condenser vacuum pressure tripping, and low lubricating oil pressure tripping appear one after another. These secondary alarms caused by changes in pressure parameters D 2 “Suppression has been achieved in the first stage.

[0070] According to the normal shutdown procedure, after destroying the vacuum and shutting down the shaft seal, shut down the hydrogen sealing oil and AC lubricating oil pump, and finally shut down the main oil tank exhaust fan. Therefore, the second stage mainly suppresses the alarm caused by the main oil tank exhaust fan.

[0071] The following is the data obtained after using the "hidden" secondary alarm: Under the shutdown transient condition, the number of alarms before configuration was 166, and the remaining alarms presented to the operator after configuration were 7, reducing the alarms by 159, and the effective reduction ratio reached 96%. Therefore, under transient conditions, the "secondary alarm suppression technology" has gained time for operators to confirm 159 alarms, greatly improving the efficiency of emergency accident handling and response, and improving the information provision of the alarm system to operators, reducing the interference of the alarm system on operators, improving their concentration, thinking ability, and control ability, effectively improving the human-machine interface, and ensuring nuclear safety.

[0072] In step S02, the following contents are also included: after one of the shutdown signal R and the lockout effective signal B appears, the suppression alarm signal C is triggered; when the shutdown signal R appears, the suppression alarm signal C triggers the original suppression condition T 1 When the blocking effective signal B appears, the suppression alarm signal C triggers the new suppression condition T 3 .

[0073] Due to the original inhibitory condition T 1 It is triggered by the shutdown signal R, which refers to the signal that appears when the reactor is shut down. This signal will appear in a nuclear power plant under transient conditions. The new suppression condition T 2 It only appears in the overhaul condition and is triggered by the lockout effective signal B. To ensure safety, the trigger conditions corresponding to the transient condition and the overhaul condition must be retained. Therefore, the following logic is added: When one of the shutdown signal R and the lockout effective signal B appears, a suppression signal C will be triggered. The suppression signal C is used to trigger the original suppression condition T 1 Or new inhibition condition T 2 However, when the shutdown signal R appears, the suppression signal C triggers the original suppression condition T 1 When the blocking effective signal B appears, the suppression alarm signal C triggers the new suppression condition T 3 .

[0074] Finally, after step S05, step S06 is further included to remove the subsequent alarm D placed in the specific alarm display list. 2 ". Due to the different situations encountered in each overhaul and transient condition, it cannot be guaranteed that the same secondary alarm needs to be suppressed each time. 2 Therefore, in this embodiment, after each working condition ends, it is necessary to remove the subsequent alarm D in the specific alarm display list. 2 ", next time, select the appropriate secondary alarm D according to the actual situation 2 ”.

Claims

1. A method for optimizing the alarm burden of a digital instrumentation and control platform of a nuclear power plant, characterized in that: The following steps are involved: Step S01, operating condition determination step: determine whether it is a transient operating condition or an overhaul operating condition. If it is a transient operating condition, proceed to step S04; if it is an overhaul operating condition, proceed to step S02; Step S02, new suppression condition acquisition step: when the function in the dedicated safety facility is locked and a lockout effective signal B is generated, the original suppression condition T1 for suppressing the alarm generation is processed with the lockout condition T2 corresponding to the function by "logical OR" to obtain a new suppression condition T3; Step S03, alarm signal D1 suppression step: eliminating the alarm signal D1 corresponding to the new suppression condition T3; Step S04, initial alarm D2' and secondary alarm D2" screening step: screening the alarm signal D2 that is bound to appear, screening out the initial alarm D2' and the secondary alarm D2" that is caused by each initial alarm D2' and is unnecessary; Step S05, subsequent alarm D2" suppression step: through configuration, when a certain initial alarm D2' occurs, its corresponding subsequent alarm D2" is suppressed and does not appear in the alarm list that the operator needs to handle; In the step S05, under the overhaul condition, the first operation stage is included: when the pressurizer pressure drops, after the corresponding dedicated safety facility generates a function lock signal, the secondary alarm D2" corresponding to the initial alarm with the pressurizer pressure low automatic shutdown set value as the alarm triggering condition is hidden; In the step S05, after the first operation stage, a second operation stage is further included: the power failure alarm of the smoke exhaust fan A is selected as the initial alarm D2' of the second stage, and its corresponding secondary alarm D2" is hidden.

2. A method for optimizing the alarm burden of a nuclear power plant digital instrumentation and control platform according to claim 1, characterized in that: In the step S05, when the initial alarm D2' occurs, the corresponding secondary alarm D2" is configured to the specific alarm display list to suppress the alarm.

3. A method for optimizing the alarm burden of a nuclear power plant digital instrumentation and control platform according to claim 2, characterized in that: After step S05, the method further comprises: Step S06, the step of unsuppressing the subsequent alarm D2" is to remove the subsequent alarm D2" placed in the specific alarm display list.

4. A method for optimizing the alarm burden of a digital instrumentation and control platform of a nuclear power plant according to claim 1, characterized in that: In step S02, after one of the shutdown signal R and the lockout effectiveness signal B appears, the suppression alarm signal C is triggered; when the shutdown signal R appears, the suppression alarm signal C triggers the original suppression condition T1, and when the lockout effectiveness signal B appears, the suppression alarm signal C triggers the new suppression condition T3.

5. A method for optimizing the alarm burden of a digital instrumentation and control platform of a nuclear power plant according to claim 1, characterized in that: In step S04, the secondary alarm D2" needs to meet one of the following conditions: it is an alarm that will definitely be issued according to the instrumentation logic or protection logic after the shutdown, it is an alarm that will be checked in the response procedure after the shutdown, or it is an alarm that will definitely be issued in the dynamic response of the system after the shutdown.

6. A method for optimizing the alarm burden of a digital instrumentation and control platform of a nuclear power plant according to claim 2, characterized in that: In the step S05, the subsequent alarm D2" added to the special alarm display list is displayed in a display column that does not require confirmation by the operator.

Images