A heterogeneous redundant control system for nuclear reactor protection system

Abstract

The present disclosure relates to a heterogeneous redundant control system for a nuclear reactor protection system, including at least two control devices, each of which includes a fixed value comparison module and a logic compliance module, each of which is implemented by an FPGA, each of which includes a first processing unit and a second processing unit, and each of which includes a third processing unit and a fourth processing unit. The heterogeneous redundant control system for a nuclear reactor protection system of the present disclosure embodiment can deploy two processing units implemented by a RISC-V-based MCU soft core and a pure hardware description language on a single-chip FPGA, while realizing redundant control, greatly reducing the intelligent processing devices required by the system, and greatly reducing the data interaction between the intelligent processing devices, with high availability and high information security.

Description

Technical Field

[0001] The present disclosure relates to the field of nuclear power safety technology, and in particular to a heterogeneous redundant control system for a nuclear reactor protection system. Background Art

[0002] As energy demand grows, nuclear energy, as an efficient and clean energy form, plays a vital role in electricity production. However, the high energy density and potential radioactive risks of nuclear reactors have attracted much attention for the safety of nuclear reactors. That is, how to ensure that nuclear reactors maintain a stable and safe operating state in a complex and changing operating environment is a key issue that needs to be solved in the nuclear energy field.

[0003] In response to the safety needs of nuclear reactors, heterogeneous redundant control systems have emerged. However, the application of heterogeneous redundant control systems in the field of nuclear reactors still faces many technical challenges. In related technologies, heterogeneous redundancy in the control system used in nuclear reactors is implemented using two different microcontroller unit (MCU) chips, which results in the control system requiring the use of more intelligent processing devices, which is not conducive to the miniaturization of the system. In addition, a large amount of data transmission is required between the redundant intelligent processing devices. Summary of the invention

[0004] In view of this, the present disclosure proposes a heterogeneous redundant control system for a nuclear reactor protection system, which deploys a RISC-V-based MCU soft core and two processing units implemented in pure hardware description language on a single-chip FPGA. While ensuring redundant control, it greatly reduces the number of intelligent processing devices required by the system and greatly reduces data interaction between intelligent processing devices, and has high availability and high information security.

[0005] According to one aspect of the present disclosure, a heterogeneous redundant control system for a nuclear reactor protection system is provided, comprising at least two control devices, each of the control devices comprising a fixed value comparison module and a logic compliance module, each of the fixed value comparison modules being respectively implemented by a field programmable gate array (FPGA), each of the fixed value comparison modules comprising a first processing unit and a second processing unit, the first processing unit being implemented by the FPGA based on a preset RISC-V instruction set, and the second processing unit being implemented by the FPGA based on a preset hardware description language; each of the logic compliance modules being respectively implemented by a field programmable gate array (FPGA), each of the logic compliance modules comprising a third processing unit and a fourth processing unit, the third processing unit being implemented by the FPGA based on a preset RISC-V instruction set, and the fourth processing unit being implemented on the FPGA based on a preset hardware description language; each of the first processing units being implemented by the FPGA based on a preset RISC-V instruction set, and the fourth processing unit being implemented on the FPGA based on a preset hardware description language; A processing unit is used to receive an input signal to be processed, determine a first comparison result according to a predetermined comparison rule, and send the first comparison result to each of the third processing units; each of the second processing units is used to receive the signal to be processed, determine a second comparison result according to the comparison rule, and send the second comparison result to each of the fourth processing units; each of the third processing units is used to perform logical conformity on each of the first comparison results received according to a predetermined logical conformity rule to obtain a first logical conformity result; each of the fourth processing units is used to perform logical conformity on each of the second comparison results received according to the logical conformity rule to obtain a second logical conformity result; wherein the signal to be processed represents the operating status of the nuclear reactor, and each of the first logical conformity result and each of the second logical conformity results are used as a basis for determining the protection action to be performed on the nuclear reactor.

[0006] In this way, the heterogeneous redundant control system simultaneously deploys a RISC-V-based processor and a pure VHDL-based logic processor on a single FPGA chip to form a heterogeneous redundant control structure. This heterogeneous redundant structure is used to implement various functions such as constant value comparison and logic compliance. While ensuring the protection logic required for redundant control, the number of intelligent processing devices required for the system is greatly reduced, and the data interaction between intelligent processing devices is greatly reduced. It has high availability and high information security to support applications in the field of reactor safety.

[0007] In a common implementation, each of the control devices further includes a communication module, each of the communication modules is implemented by a field programmable gate array FPGA, each of the communication modules includes a fifth processing unit and a sixth processing unit, the fifth processing unit is implemented on the FPGA based on a preset RISC-V instruction set, and the sixth processing unit is implemented on the FPGA based on a preset hardware description language; each of the fifth processing units is used to process the received first comparison result and the first logical coincidence result according to a predetermined processing rule, obtain a first display result, and send the first display result to the display unit; each of the sixth processing units is used to process the received second comparison result and the second logical coincidence result according to the processing rule, obtain a second display result, and send the second display result to the display unit; wherein the display unit is arranged in the system and / or outside the system, and is used to display each of the first display result and / or the second display result.

[0008] In this way, two heterogeneous processing units, namely the fifth processing unit and the sixth processing unit, are set in each communication module, so that they can perform data transmission independently, thereby improving the data transmission efficiency of the heterogeneous redundant control system 100. In addition, the communication module is implemented by FPGA. The high programmability of FPGA enables the communication module to adapt to different communication protocols and requirements. At the same time, the parallel processing capability of FPGA also ensures the high efficiency of communication and reduces the delay of data transmission.

[0009] In a possible implementation, each of the third processing units is further used to send the first comparison results received and the first logical compliance result obtained by logical compliance to the fifth processing unit in the same control device as the current third processing unit; each of the fourth processing units is further used to send the second comparison results received and the second logical compliance result obtained by logical compliance to the sixth processing unit in the same control device as the current fourth processing unit; or, each of the first processing units is further used to send the determined first comparison result to the fifth processing unit in the same control device as the current first processing unit; each of the second processing units is further used to send the determined second comparison result to the sixth processing unit in the same control device as the current second processing unit; each of the third processing units is further used to send the first logical compliance result obtained by logical compliance to the fifth processing unit in the same control device as the current third processing unit; each of the fourth processing units is further used to send the second logical compliance result obtained by logical compliance to the sixth processing unit in the same control device as the current fourth processing unit.

[0010] In this way, the third processing unit and the fourth processing unit in the system can receive and logically match the comparison results from the first processing unit and the second processing unit, respectively, and then send these logical matching results to the fifth processing unit and the sixth processing unit in the same control device. This design reduces the level and complexity of data transmission and improves the efficiency of internal communication. The system provides two data processing options. The first is that the third processing unit and the fourth processing unit logically match the comparison results from different processing units before sending them, which helps to summarize and analyze data at a higher level; the second is that the first processing unit and the second processing unit directly send the comparison results to the corresponding processing unit, and then the third processing unit and the fourth processing unit send the logical matching results separately. This method is more suitable for scenarios that require real-time processing.

[0011] In a possible implementation, the system also includes a safety trigger device; each of the third processing units is further used to send a first logic compliance result obtained by logic compliance to the safety trigger device; each of the fourth processing units is further used to send a second logic compliance result obtained by logic compliance to the safety trigger device; the safety trigger device is used to determine the control action according to the received first logic compliance results and the received second logic compliance results in accordance with a predetermined protection logic.

[0012] In this way, after the safety trigger device receives the logic compliance results sent by the third processing unit and the fourth processing unit, it can process the received logic compliance results in real time and respond quickly according to the protection logic. When an abnormal situation occurs, it can automatically trigger the corresponding control action, such as realizing the emergency shutdown of the reactor, closing the required isolation valve, etc., thereby effectively avoiding or reducing potential losses. The design of the heterogeneous redundant control system itself is to improve reliability, and the introduction of the safety trigger device further enhances this feature. Even when some processing units or components fail, the safety trigger device can still make correct decisions based on the information provided by other normally working units to ensure the stable operation of the system.

[0013] In one possible implementation, the safety trigger device includes multiple protection branches and an action generation unit, each of the protection branches is used to receive a first logic compliance result and a second logic compliance result sent by a corresponding logic compliance module, and to be turned on or off in response to the first logic compliance result and the second logic compliance result; the action generation unit is used to generate the control action according to the on-off status of each of the protection branches.

[0014] In this way, the safety trigger device can simultaneously receive and process the first logic compliance result and the second logic compliance result from different logic compliance modules, and each protection branch performs a conduction or disconnection operation according to the received logic compliance result, thereby realizing the protection of the operating state of the nuclear reactor and significantly improving the safety of the system. Since the protection branch directly responds to the logic compliance result, once an abnormal situation is detected, the protection branch will be immediately turned on or off, triggering the action generation unit to generate a corresponding control action, so as to quickly take safety measures to prevent the occurrence of potential dangers. By configuring different protection branches and action generation units, the safety trigger device can implement a flexible safety control strategy. For example, according to different application scenarios and safety requirements, the number and type of protection branches and the generation logic of the action generation unit can be adjusted to adapt to different safety requirements. In addition, through the parallel operation of multiple protection branches, the safety trigger device can still maintain some functions when some branches fail, thereby improving the fault tolerance of the system.

[0015] In a possible implementation, each of the first processing units includes a first national encryption subunit, and the first national encryption subunit is used to encrypt the first comparison result based on the determined encryption method before sending the first comparison result; each of the second processing units includes a second national encryption subunit, and the second national encryption subunit is used to encrypt the second comparison result based on the determined encryption method before sending the second comparison result; each of the third processing units includes a third national encryption subunit, and the third national encryption subunit is used to decrypt the received encrypted first comparison results, and encrypt the first logic coincidence result based on the determined encryption method before sending the first logic coincidence result; each of the fourth processing units includes a fourth national encryption subunit, and the fourth national encryption subunit is used to The encrypted second comparison results received are decrypted, and before the second logic compliance result is sent out, the second logic compliance result is encrypted based on the determined encryption method; each of the fifth processing units includes a fifth national encryption sub-unit, and the fifth national encryption sub-unit is used to decrypt the encrypted first comparison results and the first logic compliance results received, and before the first display result is sent out, the first display result is encrypted based on the determined encryption method; each of the sixth processing units includes a sixth national encryption sub-unit, and the sixth national encryption sub-unit is used to decrypt the encrypted second comparison results and the second logic compliance results received, and before the second display result is sent out, the second display result is encrypted based on the determined encryption method.

[0016] In this way, by setting the first national encryption subunit in each first processing unit, setting the second national encryption subunit in each second processing unit, setting the third national encryption subunit in each third processing unit, setting the fourth national encryption subunit in each fourth processing unit, setting the fifth national encryption subunit in each fifth processing unit, and setting the sixth national encryption subunit in each sixth processing unit, each national encryption subunit encrypts the comparison result based on a different method, which greatly enhances the security of the data. Even if a certain encryption method is cracked, other encryption methods can still provide protection, thereby achieving multi-level security protection.

[0017] In a possible implementation, the signal to be processed includes a switch signal to be processed and an analog signal to be processed, and each of the first processing units includes a corresponding first GPIO sub-unit, a first SPI sub-unit, and a second GPIO sub-unit, the first GPIO sub-unit is used to receive the switch signal to be processed, the first SPI sub-unit is used to receive the analog signal to be processed, and the second GPIO sub-unit is used to send out the first comparison result determined by the corresponding first processing unit; each of the second processing units includes a corresponding third GPIO sub-unit, a second SPI sub-unit, and a fourth GPIO sub-unit, the third GPIO sub-unit is used to receive the switch signal to be processed, the second SPI sub-unit is used to receive the analog signal to be processed, and the fourth GPIO sub-unit is used to send out the second comparison result determined by the corresponding second processing unit.

[0018] In this way, the system can process both switching signals and analog signals at the same time, which greatly broadens its application scenarios. Whether it is a digital device or an analog device, the system can effectively receive and process its signals, making it possible for connection and communication between multiple devices. It not only ensures the speed and stability of data transmission, but also improves the efficiency of data processing. By sending the comparison results in real time through the GPIO subunit, the system can quickly respond to external requests or trigger subsequent operations. This is very important for scenarios that require fast response or real-time processing.

[0019] In a possible implementation, each of the first processing units also includes a first isolation subunit connected to the first GPIO subunit, and each of the second processing units also includes a second isolation subunit connected to the third GPIO subunit, the first isolation subunit is used to obtain the switch quantity signal to be processed from the device that detects the operation status of the nuclear reactor, and send the switch quantity signal to be processed to the first GPIO subunit; the second isolation subunit is used to obtain the switch quantity signal to be processed from the device that detects the operation status of the nuclear reactor, and send the switch quantity signal to be processed to the third GPIO subunit.

[0020] In this way, the isolation sub-unit can be used to isolate the internal electrical signals of each processing unit from the external electrical signals. This isolation design can effectively prevent electromagnetic interference or other noise signals in external equipment that detects the operation of the nuclear reactor from affecting the signal processing process inside the processing unit, thereby improving the stability and accuracy of the signal.

[0021] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0023] Figure 1 A block diagram of a heterogeneous redundant control system provided according to an embodiment of the present disclosure is shown.

[0024] Figures 2 to 7 A schematic diagram of a heterogeneous redundant control system provided according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0025] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0026] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0027] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0028] In order to facilitate those skilled in the art to understand the technical solution provided by the embodiments of the present disclosure, the technical environment in which the technical solution is implemented is described below.

[0029] As the "nerve center" of nuclear reactors, the I&C system provides monitoring and control functions, and plays a vital role in the safe and stable operation of the entire facility. Among them, the safety-level I&C system performs the reactor protection function, and its reliability is particularly important. In the complex operating environment of nuclear reactors, the I&C system faces a variety of potential risks and challenges, such as equipment failure, signal interference, and human error. In order to cope with these risks, the design concept of heterogeneous redundancy came into being.

[0030] In order to solve the above technical problems, an embodiment of the present disclosure provides a heterogeneous redundant control system for a nuclear reactor protection system, the system comprising at least two control devices, each control device comprising a fixed value comparison module and a logic compliance module, each fixed value comparison module is respectively implemented by a field programmable gate array FPGA, each fixed value comparison module comprises a first processing unit and a second processing unit, the first processing unit is implemented on the FPGA based on a preset RISC-V instruction set, and the second processing unit is implemented on the FPGA based on a preset hardware description language; each logic compliance module is respectively implemented by a field programmable gate array FPGA, each logic compliance module comprises a third processing unit and a fourth processing unit, the third processing unit is implemented on the FPGA based on a preset RISC-V instruction set, and the fourth processing unit is implemented on the FPGA The above is implemented based on a preset hardware description language; each first processing unit is used to receive the input signal to be processed, determine the first comparison result according to the preset comparison rule, and send the first comparison result to each third processing unit; each second processing unit is used to receive the signal to be processed, determine the second comparison result according to the comparison rule, and send the second comparison result to each fourth processing unit; each third processing unit is used to perform logic conformity on each received first comparison result according to the preset logic conformity rule to obtain the first logic conformity result; each fourth processing unit is used to perform logic conformity on each received second comparison result according to the logic conformity rule to obtain the second logic conformity result; wherein the signal to be processed represents the operation status of the nuclear reactor, and each first logic conformity result and each second logic conformity result are used as the basis for determining the protection action for the nuclear reactor. In this way, a processing unit implemented based on the RISC-V instruction set and a processing unit implemented based on a pure hardware description language are deployed on a single-chip FPGA, which greatly reduces the intelligent processing devices required by the system while ensuring the protection logic required for redundant control, and greatly reduces the data interaction between intelligent processing devices, has high availability and high information security, and supports applications in the field of reactor safety.

[0031] Figure 1 FIG. 1 is a block diagram of a heterogeneous redundant control system for a nuclear reactor protection system provided according to an embodiment of the present disclosure. Figure 1As shown, the heterogeneous redundant control system 100 may include at least two control devices (or channels) 110 .

[0032] Each control device 110 is used to implement the protection function set for the safety of the safety-level instrumentation and control system of the nuclear reactor. The heterogeneous redundant control system 100 processes the input signals to be processed independently through multiple control devices 110, and determines the final control action for the nuclear reactor according to the output results of all control devices 110. In this way, by introducing at least two control devices 110, the redundant design of the control system is realized. This design can significantly improve the reliability and stability of the heterogeneous redundant control system 100, ensuring that when a single control device 110 fails, other normally working control devices 110 can continue to perform control tasks, thereby avoiding system crashes caused by single point failures, and greatly improving the safety of nuclear reactors.

[0033] The number of control devices 110 can be set according to actual needs. For example, four control devices 110 can be set, and a two-out-of-four inter-channel redundancy method is adopted. That is to say, if two of the four results output by the four control devices 110 indicate that the nuclear reactor needs to be protected, the heterogeneous redundant control system 100 will take control actions such as shutdown actions to protect the nuclear reactor. For another example, three control devices 110 can be set, and a two-out-of-three inter-channel redundancy method is adopted. This method is similar to the two-out-of-four inter-channel redundancy method. For the sake of brevity, this article will not go into details. It should be noted that although the number and redundancy method of the control devices 110 are introduced using the two-out-of-four and two-out-of-three inter-channel redundancy methods as examples, those skilled in the art can understand that the present disclosure should not be limited to this. In fact, users can flexibly set the number and redundancy method of the control devices 110 according to the actual application scenario.

[0034] Each control device 110 has the same structure and performs the same operations. Each control device 110 can realize the protection function through the fixed value comparison module and the logic compliance module. The fixed value comparison module can be used to realize the fixed value comparison function closely related to the protection function, and the logic compliance module can be used to realize the logic compliance function closely related to the protection function.

[0035] Figures 2 to 7 A schematic diagram of a heterogeneous redundant control system provided according to an embodiment of the present disclosure is shown. Figures 2 to 7 The heterogeneous redundant control system provided by the embodiment of the present disclosure is schematically illustrated.

[0036] In some embodiments, each control device 110 may include Figure 2The fixed value comparison module 111 and the logic compliance module 112 are shown. The system on chip (SoC) in which the heterogeneous redundant control system 100 is located includes boards for each fixed value comparison module 111 and boards for each logic compliance module 112.

[0037] Each fixed value comparison module 111 can be used to determine the comparison result according to the input signal to be processed according to the predetermined comparison rule. In fact, the input signal to be processed can be a protection variable indicating the operation status of the nuclear reactor. The protection variable may have different values ​​at different times. For example, the signal to be processed may include 5 to 10 protection fixed values ​​related to the protection logic at the current time. The comparison result can indicate the relationship between the numerical values, the event triggering situation, the operator input situation, etc. The comparison result can determine the specific indication content according to the actual protection logic set by the heterogeneous redundant control system 100 to achieve redundant control. The comparison rule can also set the specific rule content according to the actual protection logic set by the heterogeneous redundant control system 100 to achieve redundant control. For example, if the value of a certain protection variable in the input signal to be processed is greater than the preset corresponding threshold, the output comparison result is 1, otherwise it is 0. It should be noted that the embodiment of the present disclosure does not limit the comparison result and the comparison rule, and the user can flexibly set it according to the actual application scenario.

[0038] Each fixed value comparison module 111 is implemented by a field programmable gate array FPGA. In other words, the FPGA is mainly used to implement the fixed value comparison function implemented by the fixed value comparison module 111. Each fixed value comparison module 111 includes Figure 2 The first processing unit and the second processing unit are shown. Each fixed value comparison module 111 provided in the embodiment of the present disclosure realizes heterogeneous redundancy by simultaneously deploying a processor based on the RISC-V architecture and a logic processing based on a pure hardware description language on a single FPGA, that is, the protection logic independently realized by these two parts on the same FPGA, especially the logic related to the fixed value comparison function, is essentially the same, and the difference lies in the different processing methods used by each. For each fixed value comparison module 111, the first processing unit is a processor (or RISC-V processor core) based on the RISC-V architecture of the FPGA to implement the process of determining the first comparison result according to the input signal to be processed according to the predetermined comparison rule; the second processing unit is a FPGA based on a preset hardware description language to implement the same process, that is, to determine the second comparison result according to the input signal to be processed according to the predetermined comparison rule. In this way, two heterogeneous processing units, namely the first processing unit and the second processing unit, are set in each fixed value comparison module 111, so that they independently process the signal to be processed and output the comparison result, and the fixed value comparison function closely related to the protection function is realized by using a heterogeneous redundant structure, so that the heterogeneous redundant control system 100 has high availability and high information security.

[0039] It should be noted that the RISC-V processor core of each fixed value comparison module 111 provided in the embodiment of the present disclosure can be directly implemented on the basis of the processor defined by the preset RISC-V instruction set or can be further implemented by transplanting the operating system on this basis. The hardware description language used by the fixed value comparison module 111 can be a very high-speed integrated circuit hardware description language (Very-High-Speed ​​Integrated Circuit Hardware Description Language, VHDL) or other languages. The first processing unit of the fixed value comparison module 111, that is, the processor deployed on the FPGA, can be modified and implemented on the basis of other open source cores. The embodiment of the present disclosure does not limit this. The user can choose a suitable programming language and processor core according to actual application requirements. The programming language and processor core used by each logic compliance module 112 and each communication module in the following text provided in the embodiment of the present disclosure are similar to those of the fixed value comparison module 111. For the sake of brevity, this article will not repeat them.

[0040] Each logic conformity module 112 can be used to determine the logic conformity result according to the comparison result determined by each fixed value comparison module 111 and the predetermined logic conformity rule (that is, the preset protection logic). The logic conformity result can be used as a basis for determining the protection action performed on the nuclear reactor. For example, the logic conformity result output by a certain logic conformity module 112 can be expressed as a switch value 0 or 1, 0 means that the protection of the nuclear reactor needs to be started, and 1 means the opposite, so that the corresponding control action performed on the nuclear reactor can be determined by 0 or 1, for example, 0 corresponds to the shutdown action. The control action corresponding to the logic conformity result can be determined according to the actual protection logic set by the heterogeneous redundant control system 100 to achieve redundant control, and the embodiment of the present disclosure does not limit this. The logic conformity rule can also set specific rule content according to the actual protection logic set by the heterogeneous redundant control system 100 to achieve redundant control, for example, the logic conformity rule can be set by at least one of AND, OR, and NOT. It should be noted that the embodiment of the present disclosure does not limit the logic conformity result and the logic conformity rule, and the user can flexibly set it according to the actual application scenario.

[0041] Each logic conformance module 112 is implemented by a field programmable gate array FPGA. In other words, the FPGA is mainly used to implement the logic conformance function implemented by the logic conformance module 112. Each logic conformance module 112 includes Figure 2The third processing unit and the fourth processing unit are shown. Each logic compliance module 112 provided in the embodiment of the present disclosure realizes heterogeneous redundancy by simultaneously deploying a processor based on the RISC-V architecture and a logic processing based on a pure hardware description language on a single FPGA, that is, the protection logic independently implemented by these two parts on the same FPGA, especially the logic related to the logic compliance function, is essentially the same, and the difference lies in the different processing methods used. For each logic compliance module 112, the third processing unit is a processor (or RISC-V processor core) based on the RISC-V architecture of the FPGA to implement the process of determining the first logic compliance result according to the comparison result determined by each fixed value comparison module 111 according to the predetermined logic compliance rule; the fourth processing unit is an FPGA that implements the same process based on a preset hardware description language, that is, the comparison result determined by each fixed value comparison module 111 determines the second logic compliance result according to the predetermined logic compliance rule. In this way, two heterogeneous processing units, namely the third processing unit and the fourth processing unit, are set in each logic compliance module 112, so that they can independently process each comparison result and output the logic compliance result, and utilize the heterogeneous redundant structure to realize the logic compliance function closely related to the protection function, so that the heterogeneous redundant control system 100 has high availability.

[0042] The constant value comparison module 111 and the logic compliance module 112 are both implemented by FPGA, which makes the heterogeneous redundant control system 100 highly flexible and configurable. FPGA can be programmed and configured according to actual needs to implement different comparison rules and logic compliance rules, thereby adapting to different control needs. At the same time, the parallel processing capability of FPGA also improves the response speed and execution efficiency of the heterogeneous redundant control system 100.

[0043] Each first processing unit can be used to receive an input signal to be processed, determine a corresponding first comparison result according to a predetermined comparison rule to implement a fixed value comparison function, and send the first comparison result to each third processing unit. Each second processing unit can be used to receive a signal to be processed, determine a corresponding second comparison result according to a predetermined comparison rule to implement a fixed value comparison function, and send the second comparison result to each fourth processing unit.

[0044] Each first processing unit and each second processing unit can simultaneously receive a signal to be processed. The signal to be processed may include a switch quantity signal to be processed (DI signal) and an analog signal to be processed (AI signal), such as a 4-20mA current signal. Each first processing unit can simultaneously collect a switch quantity signal to be processed and an analog signal to be processed. Each second processing unit can simultaneously collect a switch quantity signal to be processed and an analog signal to be processed.

[0045] Each first processing unit may include a corresponding first general-purpose input / output (GPIO) subunit, a second GPIO subunit, and a first serial peripheral interface (SPI) subunit. Each second processing unit may include a corresponding third GPIO subunit, a fourth GPIO subunit, and a second SPI subunit.

[0046] The first GPIO sub-unit can be used to receive the switch quantity signal to be processed so that the corresponding first processing unit processes the switch quantity signal to be processed. The third GPIO sub-unit is used to receive the switch quantity signal to be processed so that the corresponding second processing unit processes the switch quantity signal to be processed. In some embodiments, each first processing unit also includes a first isolation sub-unit connected to the first GPIO sub-unit, and the first isolation sub-unit can be used to obtain the switch quantity signal to be processed from an external device for detecting the operation of the nuclear reactor, and send the switch quantity signal to be processed to the first GPIO sub-unit; each second processing unit also includes a second isolation sub-unit connected to the third GPIO sub-unit, and the second isolation sub-unit can be used to obtain the switch quantity signal to be processed from the device for detecting the operation of the nuclear reactor, and send the switch quantity signal to be processed to the third GPIO sub-unit.

[0047] In some embodiments, the first GPIO subunit and the third GPIO subunit are arranged in the SoC where the fixed value comparison module 111 is located, and the first isolation subunit and the second isolation subunit are arranged outside the SoC where the fixed value comparison module 111 is located but on the board where the fixed value comparison module 111 is located. In this way, the isolation subunits can be used to isolate the internal electrical signals of each processing unit from the external electrical signals. This isolation design can effectively prevent electromagnetic interference or other noise signals in external devices that detect the operation of the nuclear reactor from affecting the signal processing process inside the processing unit, thereby improving the stability and accuracy of the signal.

[0048] by Figure 3 Take the DI signal acquisition method provided by the embodiment of the present disclosure as an example, Figure 3 The range indicated by the double-dotted line is the range of the board where the heterogeneous redundant control system 100 is located. Figure 3 The range indicated by the dotted line is the range of the SoC of the fixed value comparison module 111 designed based on RISC-V on a single-chip FPGA. On the board of the fixed value comparison module 111, a dual redundant acquisition circuit can be set for each DI signal, that is, Figure 3As shown, a first isolation subunit and a second isolation subunit are respectively set for each DI signal on the board where the heterogeneous redundant control system 100 is located (or the board where the constant value comparison module 111 is located), the first GPIO subunit of the first processing unit is externally connected to the first isolation subunit, and the third GPIO subunit of the second processing unit is externally connected to the second isolation subunit. The first isolation subunit queries the external signal state, that is, queries whether the switch signal to be processed is on or off. The query result is collected by the first GPIO subunit of the first processing unit. The second isolation subunit is similar to the first isolation subunit, and for the sake of brevity, it will not be repeated in this article. Among them, the query results of the first isolation subunit and the second isolation subunit are the same.

[0049] The second GPIO sub-unit can be used to send the first comparison result determined by the corresponding first processing unit to the outside, for example, to each third processing unit. The fourth GPIO sub-unit can be used to send the second comparison result determined by the corresponding second processing unit to the outside, for example, to each fourth processing unit. For the second GPIO sub-unit and the fourth GPIO sub-unit, an isolation sub-unit connected thereto can also be provided. The position and function of the isolation sub-unit are the same as those of the first GPIO sub-unit and the third GPIO sub-unit, and will not be described in detail in this article for the sake of brevity.

[0050] The first SPI subunit can be used to receive an analog signal to be processed so that the corresponding first processing unit processes the analog signal to be processed. The second SPI subunit can be used to receive an analog signal to be processed so that the corresponding second processing unit processes the analog signal to be processed. In some embodiments, each first processing unit also includes a first analog-to-digital conversion circuit connected to the first SPI subunit, and each second processing unit also includes a second analog-to-digital conversion circuit connected to the second SPI subunit. The first analog-to-digital conversion circuit and the second analog-to-digital conversion circuit are respectively connected to the voltage / current conversion circuit, and the current conversion circuit can be used to realize the first analog-to-digital conversion circuit and the second analog-to-digital conversion circuit to collect the same-channel current in parallel, so that the analog signals to be processed collected by the first analog-to-digital conversion circuit and the second analog-to-digital conversion circuit are the same; the first analog-to-digital conversion circuit can be used to convert the analog signal to be processed into a corresponding digital quantity, so that the digital quantity is transmitted to the first processing unit via the first SPI subunit; the second analog-to-digital conversion circuit can be used to convert the analog signal to be processed into a corresponding digital quantity, so that the digital quantity is transmitted to the second processing unit via the second SPI subunit.

[0051] In some embodiments, the first SPI subunit and the second SPI subunit are arranged in the SoC where the fixed value comparison module 111 is located, and the first analog-to-digital conversion circuit, the second analog-to-digital conversion circuit, and the voltage / current conversion circuit are arranged outside the SoC where the fixed value comparison module 111 is located but on the board where the fixed value comparison module 111 is located. In this way, by integrating the SPI subunit and the fixed value comparison module 111 on the same board, fast and efficient transmission of digital signals can be achieved. This design reduces the delay and loss in the signal transmission process, improves the real-time and accuracy of signal processing, and at the same time, the integrated design also simplifies the wiring structure of the system, reduces the manufacturing cost and maintenance difficulty; and the analog-to-digital conversion circuit and the voltage / current conversion circuit are arranged outside the SoC but on the board, realizing the centralization of analog signal processing. This design makes full use of the integration and processing power of the SoC, improves the efficiency and accuracy of analog signal conversion, and since these circuits are arranged separately from the fixed value comparison module 111, the complexity of the board is also reduced, and the stability and reliability of the system are improved.

[0052] by Figure 4 Take the AI ​​signal acquisition method provided by the embodiment of the present disclosure as an example, Figure 4 The range indicated by the double-dotted line is the range of the board where the heterogeneous redundant control system 100 is located. Figure 4 The range indicated by the dotted line is the range of the SoC of the fixed value comparison module 111 designed based on RISC-V on a single-chip FPGA. On the board of the fixed value comparison module 111, a dual-channel analog-to-digital conversion circuit can be set for each AI signal, that is, Figure 4 As shown, a first analog-to-digital conversion circuit and a second analog-to-digital conversion circuit are respectively set on the board where the heterogeneous redundant control system 100 is located (or the board where the constant value comparison module 111 is located) for each AI signal, the first SPI subunit of the first processing unit is externally connected to the first analog-to-digital conversion circuit, and the second SPI subunit of the second processing unit is externally connected to the second analog-to-digital conversion circuit. The analog signal to be processed by the external device is converted into a digital quantity by the first analog-to-digital conversion circuit and then transmitted to the first SPI subunit of the first processing unit. The second analog-to-digital conversion circuit is similar to the first analog-to-digital conversion circuit, and for the sake of brevity, it is not repeated in this article. Among them, the conversion results of the first analog-to-digital conversion circuit and the second analog-to-digital conversion circuit are the same.

[0053] Each first processing unit may also include a corresponding first national secret subunit (such as Figure 5As shown). The first national secret subunit can be used to encrypt the first comparison result based on the determined encryption method before sending the first comparison result, so that each first processing unit can also be used to send the first comparison result encrypted by the first national secret subunit to each third processing unit. Among them, the encryption method can be set according to actual needs, and at least one encryption method can be selected for encryption. In addition to encryption processing, the first national secret subunit can also be used to decrypt data input by a communication module (see below for details), etc. The first national secret subunit can also be used in application scenarios such as key distribution and identity authentication based on encryption functions, which is not limited in the embodiments of the present disclosure.

[0054] In some embodiments, the first national secret subunit may include a national secret subunit SM2, a national secret subunit SM3, and a national secret subunit SM4. The national secret subunit SM2 can be used to implement the national secret SM2 algorithm. The national secret SM2 algorithm was released by the State Cryptography Administration in 2010. It is an asymmetric encryption algorithm based on elliptic curve cryptography, mainly used for digital signatures, key exchange and public key encryption. The national secret subunit SM2 in the first processing unit provided in the embodiment of the present disclosure can be implemented on the FPGA based on a preset hardware description language, and provide corresponding interfaces to support the call of other subunits to support applications such as identity authentication and access control, end-to-end encrypted communication, etc. The national secret subunit SM3 can be used to implement the national secret SM3 algorithm. The national secret SM3 algorithm was released by the State Cryptography Administration in 2010. Its principle is based on a cryptographic hash function, and data of any length can be mapped to a fixed-length summary. The national secret subunit SM3 in the first processing unit provided in the embodiment of the present disclosure can be implemented on the FPGA based on a preset hardware description language, and provide corresponding interfaces to support the call of other subunits to support applications related to data generation and data integrity verification. The national secret subunit SM4 can be used to implement the national secret SM4 algorithm. This algorithm was released by the State Cryptography Bureau in 2012 and is a block cipher algorithm. The national secret subunit SM4 in the first processing unit provided in the embodiment of the present disclosure implements the national secret SM4 subunit on the FPGA based on the hardware description language, and provides corresponding interfaces to support the calling of other subunits to support applications related to data encryption and communication transmission encryption. It should be noted that although the first national secret subunit is introduced with the national secret subunit SM2, the national secret subunit SM3, and the national secret subunit SM4 as examples, those skilled in the art can understand that the embodiment of the present disclosure should not be limited to this. In fact, the user can flexibly set the application mode of the national secret subunit according to the actual application scenario.

[0055] Each second processing unit may also include a corresponding second national secret sub-unit (such as Figure 5As shown). The second national secret subunit can be used to encrypt the second comparison result based on the determined encryption method before the second comparison result is sent out, so that each second processing unit can also be used to send the second comparison result encrypted by the second national secret subunit to each fourth processing unit. Among them, the encryption method can be set according to actual needs, and at least one encryption method can be selected for encryption, which is not limited in the embodiment of the present disclosure. In addition to encryption processing, the second national secret subunit can also be used to decrypt data input by the communication module (see below for details). The second national secret subunit can also be used in application scenarios such as key distribution and identity authentication based on encryption functions, which is not limited in the embodiment of the present disclosure. In some embodiments, the second national secret subunit may include the same national secret subunit as the first national secret subunit, that is, the second national secret subunit may include the above-mentioned national secret subunit SM2, national secret subunit SM3, and national secret subunit SM4. Please refer to the above for details and will not be repeated here.

[0056] In this way, by setting the first national encryption sub-unit in each first processing unit and the second national encryption sub-unit in each second processing unit, each national encryption sub-unit encrypts the comparison result based on a different method, which greatly enhances the security of the data. Even if a certain encryption method is cracked, other encryption methods can still provide protection, thus achieving multi-level security protection.

[0057] Each third processing unit can be used to perform logic conformance on each received first comparison result according to a predetermined logic conformance rule to obtain a first logic conformance result, so as to implement a logic conformance function. Each fourth processing unit can be used to perform logic conformance on each received second comparison result according to a logic conformance rule to obtain a second logic conformance result, so as to implement a logic conformance function. Each first logic conformance result and each second logic conformance result are used as a basis for determining a protection action for a nuclear reactor.

[0058] In this way, the first processing unit and the second processing unit in the constant value comparison module 111 are implemented based on the preset RISC-V instruction set and hardware description language, respectively, and the third processing unit and the fourth processing unit in the logic compliance module 112 are implemented based on the preset RISC-V instruction set and hardware description language, respectively, forming a heterogeneous processing structure, enhancing the fault tolerance of the heterogeneous redundant control system 100, even if a processing unit fails, other processing units can still work normally, ensuring the continuous operation of the heterogeneous redundant control system 100. The signal to be processed represents the operation status of the nuclear reactor, and the first logic compliance result and the second logic compliance result are used as the basis for determining the protection action for the nuclear reactor. This design enables the control system to obtain the operating status of the nuclear reactor in real time and accurately, and make corresponding control decisions based on the status information, thereby realizing accurate control of the nuclear reactor, which not only helps to improve the operating efficiency of the nuclear reactor, but also helps to ensure its safe and stable operation. The heterogeneous redundant control system 100 significantly improves the reliability, stability and safety of the system by introducing redundant design, FPGA implementation and heterogeneous processing structure, providing a strong guarantee for the safe operation of the nuclear reactor.

[0059] Similarly to each first processing unit, each third processing unit may also include a third national secret subunit, which can be used to decrypt each encrypted first comparison result received, and before sending the first logical conformity result, encrypt the first logical conformity result based on the determined encryption method, so that each third processing unit can also be used to send the first logical conformity result encrypted by the third national secret subunit to the outside (for example, the communication module described later). Among them, the encryption method can be set according to actual needs, and at least one encryption method can be selected for encryption, which is not limited in the embodiments of the present disclosure. The third national secret subunit can also be used in application scenarios such as key distribution and identity authentication based on encryption functions, which is not limited in the embodiments of the present disclosure. In some embodiments, the third national secret subunit may include the same national secret subunit as the first national secret subunit, that is, the third national secret subunit may include the above-mentioned national secret subunit SM2, national secret subunit SM3, and national secret subunit SM4. Please refer to the above for details, which will not be repeated here.

[0060] Each fourth processing unit may also be provided with a corresponding fourth country encryption subunit, and the fourth country encryption subunit included in each fourth processing unit may be used to decrypt each encrypted second comparison result received, and before sending the second logic conformity result, encrypt the second logic conformity result based on the determined encryption method, so that each fourth processing unit may also be used to send the second logic conformity result encrypted by the fourth country encryption subunit to the outside (such as the communication module described later). The rest of the settings of the fourth country encryption subunit are similar to those of each third processing unit, and for the sake of brevity, they will not be described in detail herein.

[0061] In this way, by setting a third encryption subunit in each third processing unit and a fourth encryption subunit in each fourth processing unit, the transmitted data can be decrypted and encrypted with high security.

[0062] The heterogeneous redundant control system 100 may further include a safety trigger device 120. Each third processing unit may further be used to send a first logic compliance result obtained by logic compliance to the safety trigger device 120. Each fourth processing unit may further be used to send a second logic compliance result obtained by logic compliance to the safety trigger device 120. The safety trigger device 120 may be used to determine a control action according to each received first logic compliance result and each received second logic compliance result according to a predetermined protection logic.

[0063] In this way, after the safety trigger device 120 receives the logic compliance results sent by the third processing unit and the fourth processing unit, it can process the received logic compliance results in real time and respond quickly according to the protection logic. When an abnormal situation occurs, it can automatically trigger the corresponding control action, such as realizing the emergency shutdown of the reactor, closing the required isolation valve, etc., thereby effectively avoiding or reducing potential losses. The heterogeneous redundant control system 100 itself is designed to improve reliability, and the introduction of the safety trigger device 120 further enhances this feature. Even when some processing units or components fail, the safety trigger device 120 can still make correct decisions based on the information provided by other normally working units to ensure the stable operation of the system.

[0064] The safety trigger device 120 may include multiple protection branches and an action generation unit. Each protection branch may be used to receive the first logic compliance result and the second logic compliance result sent by the corresponding logic compliance module 112, and be turned on or off in response to the first logic compliance result and the second logic compliance result. The action generation unit may be used to generate a control action according to the on-off condition of each protection branch.

[0065] In this way, the safety trigger device 120 can simultaneously receive and process the first logic compliance result and the second logic compliance result from different logic compliance modules 112, and each protection branch performs a conduction or disconnection operation according to the received logic compliance result, thereby realizing real-time monitoring of the operation status of the nuclear reactor. This design can timely discover potential safety risks and take corresponding measures to significantly improve the safety of the system. Since the protection branch directly responds to the logic compliance result, once an abnormal situation is detected, the protection branch will be immediately turned on or off, triggering the action generation unit to generate a corresponding control action, so as to quickly take safety measures to prevent the occurrence of potential dangers. By configuring different protection branches and action generation units, the safety trigger device 120 can implement a flexible safety control strategy, for example, according to different application scenarios and safety requirements, the number and type of protection branches and the generation logic of the action generation unit can be adjusted to adapt to different safety requirements. In addition, through the parallel operation of multiple protection branches, the safety trigger device 120 can still maintain some functions when some branches fail, thereby improving the fault tolerance of the system.

[0066] In one example, if Figure 6 As shown, the heterogeneous redundant control system 100 includes four control devices 110, namely Figure 6 The C1 channel, C2 channel, C3 channel, and C4 channel in the embodiment of the present invention are shown in FIG. Each channel includes the above-mentioned fixed value comparison module 111 and logic coincidence module 112. Each channel processes the collected protection variables at the same time and outputs the corresponding logic coincidence results. Figure 6 C1-A indicates the first logical matching result output by the third processing unit in the C1 channel, i.e., the switch value 0 or 1. Figure 6 C1-B represents the second logic matching result output by the fourth processing unit in the C1 channel, i.e., the switch value 0 or 1. Figure 6 The same applies to C2-A and the rest. Each channel sends the output first logic coincidence result and second logic coincidence result to the corresponding protection branch in the safety trigger device 120. Figure 7 As shown, the safety triggering device 120 includes four protection branches, namely a first protection branch 121 , a second protection branch 122 , a third protection branch 123 , and a fourth protection branch 124 . Figure 7 The first protection branch 121 is provided with two switches corresponding to C1-A and C2-A respectively. The on-off status of the first protection branch 121 can be determined by the two switches: if C1-A and C2-A are both 1, the first protection branch 121 is turned on, and in other cases (for example, C1-A is 0 and C2-A is 1), the first protection branch 121 is turned off. The other protection branches are similar to the first protection branch 121. Figure 7The illustrated correspondence between the protection branches and the channels is a two-out-of-four redundancy between channels. In this case, if both C1-A and C4-A received by the safety trigger device 120 are 0, then Figure 7 The first protection branch 121 and the third protection branch 123 are both disconnected, so that the action generation unit in the safety trigger device 120 can generate a shutdown action according to the on-off condition that the first protection branch 121 and the third protection branch 123 are both disconnected, thereby disconnecting the connection between the drive device and the actuator, so that the execution structure performs a shutdown action on the nuclear reactor and related process systems to play a protective role.

[0067] In some embodiments, each control device 110 may further include a communication module (not shown), which may perform data transmission with a constant value comparison module 111 and / or a logic coincidence module 112 in the same control device 110. The SoC in which the heterogeneous redundant control system 100 is located also includes boards for each communication module.

[0068] Each communication module can be used to determine the display result according to the received data and the predetermined processing rules, and transmit the display result to the display unit. The data received by each communication module may include a logic compliance result and / or a comparison result. The processing rules may also set specific rule content according to the actual protection logic set by the heterogeneous redundant control system 100 to implement redundant control. The display result may determine the specific display content according to the actual protection logic set by the heterogeneous redundant control system 100 to implement redundant control. The display unit can be used to selectively display the display result. The display unit can be set in the heterogeneous redundant control system 100 and / or outside the heterogeneous redundant control system 100. It should be noted that the embodiment of the present disclosure does not limit the position and displayed content of the display unit, the data received by the communication module, and the processing rules, and the user can flexibly set them according to the actual application scenario.

[0069] Each communication module is implemented by a field programmable gate array FPGA. In other words, this FPGA is mainly used to implement the data transmission function of the communication module. Each communication module includes a fifth processing unit and a sixth processing unit. Each communication module provided in the embodiment of the present disclosure realizes heterogeneous redundancy by simultaneously deploying a processor based on the RISC-V architecture and a logic processing based on a pure hardware description language on a single FPGA, that is, the two parts on the same FPGA independently realize the data transmission function, and the difference lies in the different implementation methods used. For each communication module, the fifth processing unit is a processor (or RISC-V processor core) based on the RISC-V architecture of the FPGA to implement the process of determining the first display result according to the received data according to the predetermined processing rules; the sixth processing unit is the FPGA based on a preset hardware description language to implement the same process, that is, the second display result is determined according to the received data according to the predetermined processing rules. In this way, two heterogeneous processing units, namely the fifth processing unit and the sixth processing unit, are set in each communication module, so that they can perform data transmission independently, thereby improving the data transmission efficiency of the heterogeneous redundant control system 100. In addition, the communication module is implemented by FPGA. The high programmability of FPGA enables the communication module to adapt to different communication protocols and requirements. At the same time, the parallel processing capability of FPGA also ensures the high efficiency of communication and reduces the delay of data transmission.

[0070] by Figure 6 The C1 channel shown schematically illustrates the communication module. The C1 channel may include a fixed value comparison module 111, a logic compliance module 112 (including a third processing unit and a fourth processing unit), and a communication module (including a fifth processing unit and a sixth processing unit) (not shown). The data received by the communication module in the channel comes from the fixed value comparison module 111 and / or the logic compliance module 112. In the case where all the data received by the communication module comes from the logic compliance module 112, the data received by the fifth processing unit of the communication module comes from the third processing unit of the logic compliance module 112, and the data received by the sixth processing unit of the communication module comes from the fourth processing unit of the logic compliance module 112.

[0071] In some embodiments, the data received by each communication module may include a first comparison result and a first logical match result. Each fifth processing unit may be used to implement the above-mentioned data transmission function, that is, according to a predetermined processing rule, the received first comparison result and the first logical match result are processed to obtain a first display result, and the first display result is sent to the display unit. Each sixth processing unit may be used to implement the above-mentioned data transmission function, that is, according to the processing rule, the received second comparison result and the second logical match result are processed to obtain a second display result, and the second display result is sent to the display unit. The display unit may be used to display each first display result and / or second display result.

[0072] In a possible implementation, each third processing unit is further configured to send each received first comparison result and the first logic compliance result obtained by logic compliance to a fifth processing unit in the same control device 110 as the current third processing unit; each fourth processing unit is further configured to send each received second comparison result and the second logic compliance result obtained by logic compliance to a sixth processing unit in the same control device 110 as the current fourth processing unit. In this way, the first comparison result and the first logic compliance result received by each communication module may all come from the corresponding logic compliance module 112.

[0073] In a possible implementation, each first processing unit is further used to send the determined first comparison result to the fifth processing unit, and each third processing unit is further used to send the first logical compliance result obtained by logical compliance to each fifth processing unit, wherein the fifth processing unit and the first processing unit that sends the first comparison result and the third processing unit that sends the first logical compliance result are in the same control device 110; each second processing unit is further used to send the determined second comparison result to each sixth processing unit, and each fourth processing unit is further used to send the second logical compliance result obtained by logical compliance to each sixth processing unit, wherein the sixth processing unit and the second processing unit that sends the second comparison result and the fourth processing unit that sends the second logical compliance result are in the same control device 110. In this way, the first comparison result and the first logical compliance result received by each communication module are derived from the corresponding logical compliance module 112 and the fixed value comparison module 111.

[0074] In this way, the heterogeneous redundant control system provided by the embodiment of the present disclosure simultaneously deploys a RISC-V-based processor and a pure VHDL language-based logic processing on a single FPGA chip to form a heterogeneous redundant control structure. This heterogeneous redundant structure is used to implement various functions such as constant value comparison and logic compliance, so that the heterogeneous redundant control system has high availability and high information security.

[0075] Similarly to each first processing unit, each fifth processing unit may also include a fifth national secret subunit, which can be used to decrypt the received encrypted first comparison results and first logical compliance results, and before sending the first display result, encrypt the first display result based on the determined encryption method, so that each fifth processing unit can also be used to send the first display result encrypted by the fifth national secret subunit to the display unit. Among them, the encryption method can be set according to actual needs, and at least one encryption method can be selected for encryption, which is not limited in the embodiment of the present disclosure. The fifth national secret subunit can also be used in application scenarios such as key distribution and identity authentication based on encryption functions, which is not limited in the embodiment of the present disclosure. In some embodiments, the fifth national secret subunit may include the same national secret subunit as the first national secret subunit, that is, the fifth national secret subunit may include the above-mentioned national secret subunit SM2, national secret subunit SM3, and national secret subunit SM4. Please refer to the above for details, which will not be repeated here.

[0076] Each sixth processing unit may also be provided with a corresponding sixth national encryption subunit, and the sixth national encryption subunit included in each sixth processing unit may be used to decrypt the received encrypted second comparison results and second logical matching results, and before sending the second display result, encrypt the second display result based on the determined encryption method, so that each sixth processing unit may also be used to send the second display result encrypted by the sixth national encryption subunit to the display unit. The rest of the settings of the sixth national encryption subunit are similar to those of the fifth processing units, and will not be described in detail herein for the sake of brevity.

[0077] In this way, by setting the fifth national encryption subunit in each fifth processing unit and the sixth national encryption subunit in each sixth processing unit, each national encryption subunit encrypts the logical matching results and comparison results based on an appropriate method, which greatly enhances the security of the data.

[0078] The first processing unit in each control device 110 of the heterogeneous redundant control system 100 provided in the embodiment of the present disclosure, in addition to deploying a RISC-V based MCU soft core on a single-chip FPGA, such as Figure 5As shown, the MCU soft core is also equipped with read-only memory (ROM), random access memory (RAM), SPI, GPIO, universal asynchronous receiver / transmitter (UART), two-wire serial bus (I2C), timer (TIMER) and watchdog (Watchdog) modules through the system bus (AHB) and peripheral bus (APB). The bridge between the system bus and the peripheral bus is realized through the bus bridge (APB Bridge). Each peripheral interface (SPI, GPIO, UART, I2C) is added in the form of an IP soft core and deployed on the FPGA together with the MCU soft core. The number of various peripheral interfaces can be determined according to the application requirements and the resource conditions of the selected FPGA. On this basis, the protection logic module is deployed according to the protection function requirements to realize the specific protection logic. In addition, in order to realize the debugging function, the JTAG debugging interface support corresponding to the MCU is also realized. The third processing unit and the fifth processing unit in each control device 110 are similar to the first processing unit and include the above-mentioned parts. Hereinafter, the first processing unit, the third processing unit, and the fifth processing unit including the above-mentioned parts will be referred to as the processor part, which is similar to the use of a traditional MCU. Various interface functions and protection logics can be implemented using a programming language for the processor.

[0079] On the same FPGA, a special area is opened up, that is, the logic part of pure hardware description language, such as pure VHDL logic part. Based on the combinational logic and timing logic corresponding to the VHDL language, peripheral functions such as SPI, GPIO, UART, I2C, TIMER and protection logic programs are implemented. This is the pure VHDL logic part (that is, the second processing unit, the fourth processing unit, and the sixth processing unit), which is heterogeneous and redundant with the processor part. On the basis of each basic functional module, the pure VHDL logic part also uses VHDL language to directly implement the corresponding protection logic. The protection logic and each basic functional module run based on their own state machine, and each module can run in parallel.

[0080] The above-mentioned MCU soft core can be implemented based on the RISC-V architecture, and is used to implement the CPU's instruction execution, arithmetic and logical operations, clock management, address allocation and storage resource management, power management, interrupt management, general IO management and other functions. The above-mentioned system bus can be used to realize data interaction between the MCU soft core and the internal ROM, RAM, bus bridge, national secret module, etc. The peripheral bus can be used to realize data interaction with various external interfaces. The above-mentioned bus bridge can be used for bridging between the system bus and the peripheral bus. The above-mentioned SPI module may include a first SPI subunit, a second SPI subunit and other SPI subunits for data interaction, which can be used to implement the SPI interface protocol and support data interaction with external devices or equipment via the SPI protocol. External devices or devices that support the SPI interface protocol include EEPROM, FLASH, real-time clock chips, analog-to-digital and digital-to-analog conversion chips, etc. The above-mentioned GPIO module may include a first GPIO subunit, a second GPIO subunit, a third GPIO subunit, a fourth GPIO subunit and other GPIO subunits for input and output data, which can be used to realize the general input and output port function and support connection with external devices or equipment via GPIO pins. External devices or equipment connected via GPIO include LED lights, buttons, etc. The above-mentioned UART module can be used to implement the asynchronous communication interface function and support serial communication with external devices. The above-mentioned I2C module can be used to implement the synchronous serial interface function and support serial communication with external devices. The above-mentioned TIMER module can be used to implement timing and counting functions. The above-mentioned Watchdog module can be used to implement the watchdog function.

[0081] In the processor part, the national secret sub-unit (for example, the first national secret sub-unit in the first processing unit) is deployed via the system bus, so that the heterogeneous redundant control system 100 can perform data encryption through the national secret algorithm. The corresponding national secret algorithm soft core (for example, the second national secret sub-unit in the second processing unit) is also implemented in the pure VHDL logic part for other communication interface modules to call, so that the information security capability of the heterogeneous redundant control system 100 can be improved. In this way, since each processing unit in each control device in the heterogeneous redundant control system 100 includes a national secret sub-unit, and the national secret sub-unit is implemented by FPGA based on a preset hardware description language, the heterogeneous redundant control system 100 can be easily adjusted or expanded as needed, for example, more national secret sub-units can be added to meet higher encryption requirements, or the existing encryption method can be changed to meet new security standards.

[0082] The heterogeneous redundant control system 100 receives data through each peripheral interface (SPI, GPIO, UART, I2C) to realize the data acquisition function. The corresponding data is transmitted to the MCU soft core via the bus to complete arithmetic and logical operations. The operation results are stored in the on-chip RAM and then returned to each peripheral interface via the bus. Each peripheral interface outputs data to a peripheral component or device to realize the corresponding control function, or transmits it to a component or device with a human-machine interface function via the peripheral interface to realize the monitoring function. The IP soft core of each peripheral interface can be implemented based on the hardware description language by itself, or an open source module can be used, which is not limited in the embodiment of the present disclosure.

[0083] In the previous protection system, the heterogeneous redundancy of the above modules is realized by two independent processor chips and boards of different architectures, or by one independent processor chip and board and one independent FPGA chip and board. In the heterogeneous redundant control system 100 provided in the embodiment of the present disclosure, the constant comparison module 111, the logic coincidence module 112, and the communication module all support the control device 110 with heterogeneous dual redundant hot standby function and national secret algorithm function on a single-chip FPGA based on the RISC-V processor core and pure VHLD logic. The first processing unit (i.e., the processor part) and the second processing unit (the pure VHDL logic part) in each control device 110 simultaneously collect the signal to be processed. After completing the signal collection, the collected data are compared with the protection setting value, and then the results are respectively output to the third processing unit and the fourth processing unit of the logic compliance module 112 in the control device 110, and are also output to the corresponding processing units of the logic compliance modules 112 of other redundant control devices 110. After receiving the comparison results, the third processing unit and the fourth processing unit of the logic compliance module 112 complete the logic compliance according to the predetermined logic compliance rules related to the protection logic, and respectively output the corresponding logic compliance results (for example, Figure 6 At the same time, some information that needs to be monitored (comparison results and / or logic matching results) will be transmitted to the display unit via the communication module so that the user can view it in real time.

[0084] The heterogeneous redundant control system 100 provided by the embodiment of the present disclosure enables the functions of the MCU and the functions of pure VHDL logic to be implemented on a single-chip FPGA, thereby improving the functional integration of the device and significantly reducing the number of intelligent processing devices required by the system. This improves the basic reliability of the system and is also conducive to the low-power and miniaturized design of the equipment. At the same time, the processor and protection logic are implemented based on the hardware description language and can be deployed on various FPGAs with resource conditions, with better portability. In addition, it can support the calling of national secret modules to realize identity authentication and encrypted communication, with higher confidentiality.

[0085] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A heterogeneous redundant control system for a nuclear reactor protection system, characterized in that: It comprises at least two control devices, each of which comprises a fixed value comparison module and a logic coincidence module. Each of the fixed value comparison modules is implemented by a field programmable gate array FPGA, and each of the fixed value comparison modules includes a first processing unit and a second processing unit, wherein the first processing unit is implemented on the FPGA based on a preset RISC-V instruction set, and the second processing unit is implemented on the FPGA based on a preset hardware description language; Each of the logic conformance modules is implemented by a field programmable gate array FPGA, and each of the logic conformance modules includes a third processing unit and a fourth processing unit, wherein the third processing unit is implemented on the FPGA based on a preset RISC-V instruction set, and the fourth processing unit is implemented on the FPGA based on a preset hardware description language; Each of the first processing units is used to receive an input signal to be processed, determine a first comparison result according to a predetermined comparison rule, and send the first comparison result to each of the third processing units; Each of the second processing units is used to receive the signal to be processed, determine a second comparison result according to the comparison rule, and send the second comparison result to each of the fourth processing units; Each of the third processing units is used to perform logic matching on each of the received first comparison results according to a predetermined logic matching rule to obtain a first logic matching result; Each of the fourth processing units is used to perform logic conformance on each of the received second comparison results according to the logic conformance rule to obtain a second logic conformance result; The signal to be processed represents the operation status of the nuclear reactor, and each of the first logic coincidence results and each of the second logic coincidence results are used as a basis for determining a protection action to be performed on the nuclear reactor; Each of the first processing units includes a first national encryption subunit, and the first national encryption subunit is used to encrypt the first comparison result based on the determined encryption method before sending the first comparison result; Each of the second processing units includes a second national encryption subunit, and the second national encryption subunit is used to encrypt the second comparison result based on the determined encryption method before sending the second comparison result; Each of the third processing units includes a third encryption subunit, and the third encryption subunit is used to decrypt each of the received encrypted first comparison results, and encrypt the first logic coincidence result based on the determined encryption method before sending the first logic coincidence result; Each of the fourth processing units includes a fourth encryption subunit, which is used to decrypt each of the received encrypted second comparison results, and encrypt the second logic compliance result based on the determined encryption method before sending the second logic compliance result.

2. The system according to claim 1, characterized in that Each of the control devices further includes a communication module, each of the communication modules is implemented by a field programmable gate array FPGA, each of the communication modules includes a fifth processing unit and a sixth processing unit, the fifth processing unit is implemented on the FPGA based on a preset RISC-V instruction set, and the sixth processing unit is implemented on the FPGA based on a preset hardware description language; Each of the fifth processing units is used to process the received first comparison result and the first logical coincidence result according to a predetermined processing rule to obtain a first display result, and send the first display result to the display unit; Each of the sixth processing units is used to process the received second comparison result and the second logic matching result according to the processing rule to obtain a second display result, and send the second display result to the display unit; Wherein, the display unit is arranged inside the system and / or outside the system, and is used to display each of the first display results and / or the second display results; Each of the fifth processing units includes a fifth encryption subunit, and the fifth encryption subunit is used to decrypt the received encrypted first comparison results and the first logical coincidence results, and encrypt the first display results based on the determined encryption method before sending the first display results; Each of the sixth processing units includes a sixth encryption subunit, which is used to decrypt the received encrypted second comparison results and second logical matching results, and encrypt the second display results based on the determined encryption method before sending the second display results.

3. The system according to claim 2, characterized in that Each of the third processing units is further configured to send the received first comparison results and the first logic matching result obtained by logic matching to a fifth processing unit in the same control device as the current third processing unit; Each of the fourth processing units is further configured to send the second comparison results received and the second logic matching results obtained by logic matching to each of the sixth processing units in the same control device as the current fourth processing unit; or, Each of the first processing units is further used to send the determined first comparison result to a fifth processing unit in the same control device as the current first processing unit; each of the second processing units is further used to send the determined second comparison result to a sixth processing unit in the same control device as the current second processing unit; Each of the third processing units is also used to send the first logical compliance result obtained by logical compliance to the fifth processing unit in the same control device as the current third processing unit; each of the fourth processing units is also used to send the second logical compliance result obtained by logical compliance to the sixth processing unit in the same control device as the current fourth processing unit.

4. The system according to claim 1, characterized in that The system also includes a safety trigger device; Each of the third processing units is further configured to send a first logic matching result obtained by logic matching to the safety trigger device; Each of the fourth processing units is further configured to send a second logic matching result obtained by logic matching to the safety trigger device; The safety trigger device is used to determine a control action according to the received first logic compliance results and the received second logic compliance results according to a predetermined protection logic.

5. The system according to claim 4, characterized in that The safety trigger device includes multiple protection branches and an action generation unit. Each of the protection branches is used to receive a first logic compliance result and a second logic compliance result sent by a corresponding logic compliance module, and to be turned on or off in response to the first logic compliance result and the second logic compliance result; The action generation unit is used to generate the control action according to the on / off status of each of the protection branches.

6. The system according to claim 1, characterized in that The signals to be processed include switch signals to be processed and analog signals to be processed. Each of the first processing units includes a corresponding first GPIO subunit, a first SPI subunit, and a second GPIO subunit, wherein the first GPIO subunit is used to receive the switch signal to be processed, the first SPI subunit is used to receive the analog signal to be processed, and the second GPIO subunit is used to send the first comparison result determined by the corresponding first processing unit to the outside; Each of the second processing units includes a corresponding third GPIO sub-unit, a second SPI sub-unit, and a fourth GPIO sub-unit. The third GPIO sub-unit is used to receive the switch signal to be processed, the second SPI sub-unit is used to receive the analog signal to be processed, and the fourth GPIO sub-unit is used to send the second comparison result determined by the corresponding second processing unit to the outside.

7. The system according to claim 6, characterized in that Each of the first processing units further includes a first isolation subunit connected to the first GPIO subunit, and each of the second processing units further includes a second isolation subunit connected to the third GPIO subunit. The first isolation subunit is used to obtain the switch quantity signal to be processed from the device that detects the operation status of the nuclear reactor, and send the switch quantity signal to be processed to the first GPIO subunit; The second isolation sub-unit is used to obtain the switch quantity signal to be processed from the device that detects the operation status of the nuclear reactor, and send the switch quantity signal to be processed to the third GPIO sub-unit.

Images