A logic reset control system for nuclear power plant safety level protection system

Abstract

The present invention relates to the field of digital instrumentation and control for nuclear power plants, and more specifically, to a logic reset control system for a nuclear power plant's safety-level protection system. The system comprises a reset logic control unit for performing logical processing on input signals and outputting a reset control signal to a processing unit. The system is also configured to receive configuration data set by a user based on actual application requirements and, based on the configuration data, perform post-reset processing and safety behavior output until the fault condition is eliminated or the user confirms the reset is released. This system allows users to configure post-reset processing measures and safety output behaviors during the reset period based on application requirements. This system can improve the availability of the nuclear power plant's safety-level protection system in the event of transient recoverable faults and avoid the safety hazards caused by frequent restarts in the event of serious non-recoverable faults.

Description

Technical Field

[0001] The present invention relates to the field of digital instrumentation and control for nuclear power plants, and in particular to a logic reset control system for a safety-level protection system of a nuclear power plant. Background Art

[0002] Among the various functional modules that make up the control system, those with processing units all involve reset. Reset is also a common method for handling fault conditions such as software failures and power failures. After reset, the system is typically maintained in the reset state or restarted. However, these methods have certain limitations in nuclear power plant protection systems. Reset is not necessarily a safe state. For example, reset cannot flexibly handle analog outputs configured in a safe state for different applications. Furthermore, maintaining the reset state after reset inevitably reduces overall system availability in the event of a transient, recoverable fault. Restarting after reset inevitably leads to frequent system restarts in the event of a serious, unrecoverable fault, compromising system safety. Summary of the Invention

[0003] The purpose of the present invention is to provide a logic reset control system for a nuclear power plant safety level protection system, so as to solve the problem that the output safety behavior and action form of the current nuclear power plant safety level protection system after reset cannot be flexibly configured according to the application scenario.

[0004] The present invention is achieved through the following technical solutions:

[0005] A logic reset control system for a safety-level protection system of a nuclear power plant, comprising a reset logic control unit; the reset logic control unit is used to perform logic processing on a received input signal, and if the logic processing result is a fault, output a reset control signal to a processing unit of a system function module; the input signal includes a voltage signal of the system function module, an operation fault signal of the processing unit, and a diagnostic signal output by the processing unit; the reset control signal is used to trigger the processing unit to reset; the reset logic control unit is also used to receive a post-reset processing control instruction and output behavior control instruction configuration information configured by a user according to actual application requirements, and output the output The output behavior control instruction configuration information is sent to the output unit of the system function module, and when the reset post-processing control instruction is a reset hold instruction, the reset is held according to the reset hold instruction until the reset is released after receiving the reset release confirmation information sent by the user; when the reset post-processing control instruction is a reset restart instruction, it is determined whether the fault is lifted according to the reset source information recorded during the previous reset, the diagnostic information recorded during the previous reset and the input signal; if so, reset and restart are performed, otherwise reset and hold are performed until the reset is released after receiving the reset release confirmation information; the output behavior control instruction configuration information includes output hold or output disconnection.

[0006] Furthermore, the logic reset control system also includes a power supply diagnostic unit; the power supply diagnostic unit is used to set the functional voltage threshold range of the system functional module, and to collect the real-time functional voltage of the system functional module, and compare the real-time functional voltage with the functional voltage threshold. If the real-time functional voltage is greater than the maximum functional voltage threshold, an overvoltage signal is output to the reset logic control unit; if the real-time functional voltage is less than the minimum functional voltage threshold, an undervoltage signal is output to the reset logic control unit.

[0007] Furthermore, the logic reset control system also includes a program monitoring unit; the program monitoring unit is used to collect the heartbeat signal of the processing unit, and monitor the program running status of the processing unit according to the heartbeat signal. If the program running status monitoring result is that the program runs away or the program times out, the operation fault signal is output to the reset logic control unit.

[0008] Furthermore, the program monitoring unit adopts an independent watchdog; the independent watchdog is implemented by a dedicated watchdog circuit or CPLD.

[0009] Furthermore, the reset logic control unit receives the diagnostic signal sent by the processing unit through the digital interface, and the reset logic control unit sends the reset control signal to the processing unit through the digital interface; the digital interface adopts SPI serial bus or I 2 C serial bus.

[0010] Furthermore, the logic reset control system also includes a communication unit; the communication unit is used to forward the post-reset processing control instructions and the output behavior control instruction configuration information; the user sends the post-reset processing control instructions and the output behavior control instruction configuration information to the communication unit through the maintenance network, and then passes them to the processing unit; the communication unit is connected to the processing unit.

[0011] Furthermore, the logic reset control system also includes a memory unit; the memory unit is bidirectionally connected to the reset logic control unit; the memory unit is used to store post-reset processing control instructions, output behavior control instruction configuration information, reset source information and diagnostic information; the memory unit uses a non-volatile memory; the non-volatile memory uses an SPI Flash chip or an EEPROM chip.

[0012] Furthermore, the logic reset control system also includes an output control unit; the output control unit receives the behavior control instructions sent by the reset logic control unit and the control instructions sent by the processing unit, and sends a drive signal to the output unit according to the behavior control instructions and the control instructions.

[0013] Furthermore, the logic reset control system also includes a debugging interface unit; the debugging interface unit is used to provide an interface for an external debugging device to access the processing unit. When the external debugging device accesses the processing unit through the debugging interface unit, the debugging interface unit sends the reset release confirmation information to the reset logic control unit; the debugging interface unit selects a program debugging interface or a program burning interface supported by the processing unit.

[0014] Furthermore, the logic reset control system further includes a manual reset unit; the manual reset unit is used to write the reset release confirmation information to the reset logic control unit when the user manually releases the reset.

[0015] Compared with existing technologies, the present invention has the following advantages and beneficial effects: Reset logic is configured through a maintenance network. Users can manually configure the system's post-reset actions to maintain reset or restart, depending on application requirements. When configured to maintain reset, the reset can be manually released using a manual key or debugging device. When configured to restart, the processor chooses to maintain a safe state or operate normally based on the reset source's recorded status and diagnostic information, and whether the fault has been resolved. This improves system availability in the event of transient recoverable faults and avoids the safety risks associated with frequent restarts in the event of serious unrecoverable faults. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without making any creative efforts.

[0017] Figure 1 A schematic diagram of the hardware structure of the logic reset control system provided in an embodiment of the present invention;

[0018] Figure 2 A schematic diagram of the logic processing of input signals of a reset logic control unit provided by an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of the reset logic processing flow provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with examples and drawings. The exemplary embodiments of the present invention and their descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0021] Example

[0022] like Figure 1-3 As shown together, an embodiment of the present invention provides a logic reset control system for a nuclear power plant safety-level protection system, comprising a debugging interface unit, a manual reset unit, a power diagnostic unit, a program monitoring unit, a reset logic control unit, a memory unit, an output control unit, and a communication unit. The reset logic control unit is connected to the debugging interface unit, the manual reset unit, the power diagnostic unit, the program monitoring unit, the memory unit, the processing unit, and the output control unit, respectively. The debugging interface unit, the manual reset unit, the power diagnostic unit, and the program monitoring unit serve as inputs to the reset logic control unit and are unidirectionally connected to the reset logic unit.

[0023] 1. Reset logic unit

[0024] The reset logic control unit is used to perform logic processing on the input signal received. If the result of the logic processing is a serious fault, it outputs a reset control signal to the processing unit of the system function module. Among them, the input signal includes the voltage signal of the system function module, the operation fault signal of the processing unit and the diagnostic signal output by the processing unit; the reset control signal is used to trigger the processing unit to reset. In terms of connection relationship, the reset logic control unit receives the diagnostic signal sent by the processing unit through the digital interface, and sends the reset control signal to the processing unit through the digital interface; the digital interface adopts SPI serial bus, I 2 C serial bus and other serial buses. The diagnostic signals sent by the processing unit to the reset logic control unit include the processing unit's own self-diagnostic signal, channel diagnostic signals corresponding to different functional modules, and communication diagnostic signals. Self-diagnostic signal methods are selected based on different diagnostic objects and characteristics. For example, for memory, read and write operations combined with data verification technology are used to diagnose different areas one by one. For channels, invasive diagnostic technology, non-invasive diagnostic technology, or a combination of the two diagnostic technologies are used according to the characteristics of the input signal. Communication diagnosis is performed using serial number identification, data verification and other technologies.

[0025] The reset logic control unit input signal logic processing diagram is as follows Figure 2As shown in the figure. To accurately implement fault classification and precisely match different faults to different output behaviors, maximizing availability while ensuring safety, the reset logic control unit's input signals are categorized by voltage diagnostic over-limit signals, program monitoring anomaly signals (including sub-items such as program runaway and program timeout), processing unit self-diagnostic signals (including sub-items such as memory diagnostics and bus diagnostics), channel diagnostic signals (including sub-items such as channel accuracy diagnostics and connectivity diagnostics), and communication diagnostic signals (including sub-items such as communication timeout, communication data checksum, and communication packet loss). Each sub-item is assigned a score based on its impact and importance. The reset logic control unit manages the accumulation of different input signal anomaly scores and the clearing of instantaneous fault integrals based on the operating status of the entire functional module. It then outputs reset signals and safety outputs based on the accumulated scores, depending on the configuration. The reset fault accumulation threshold and safety output fault accumulation threshold are set separately. For example, the reset fault accumulation threshold is set to 8, and the safety output accumulation threshold is set to 6. The individual score of serious fault items such as core power supply exceeding the limit and program error is set to 8; fault items that affect the operation results of other modules or system output results, such as communication timeout, communication data error and other important faults, are set according to the individual score of 1 to 3; the individual faults that do not affect the normal operation of other modules, such as single-channel accuracy exceeding the limit and memory data verification abnormality, are set according to the individual score of 0.5 to 1.

[0026] The reset logic control unit is also used to receive post-reset processing control instructions and output behavior control instruction configuration information configured by the user based on actual application requirements, and to send the output behavior control instruction configuration information to the output unit of the system function module. When the post-reset processing control instruction is a reset hold instruction, the reset is held according to the reset hold instruction until the reset is released after receiving the reset release confirmation information sent by the user. When the post-reset processing control instruction is a reset restart instruction, it determines whether the fault has been resolved based on the reset source information recorded during the previous reset, the diagnostic information recorded during the previous reset, and the input signal. If so, a reset restart is performed; otherwise, a reset hold is performed until the reset is released after receiving the reset release confirmation information. Whether the fault has been resolved is determined based on the classification and processing of hardware faults and software faults. For hardware faults such as power supply faults, the corresponding abnormal items and scores are cleared based on the filtered diagnosis results of the real-time voltage acquisition. For software diagnostic items that require the participation of the processing unit, the abnormal items and scores are cleared after the reset. In addition, the output behavior control instruction configuration information includes output hold or output disconnection.

[0027] 2. Power supply diagnostic unit

[0028] The power supply diagnostic unit is used to set the functional voltage threshold range of the system functional module, and to collect the real-time functional voltage of the system functional module, and compare the real-time functional voltage with the functional voltage threshold. If the real-time functional voltage is greater than the maximum functional voltage threshold, an overvoltage signal is output to the reset logic control unit; if the real-time functional voltage is less than the minimum functional voltage threshold, an undervoltage signal is output to the reset logic control unit.

[0029] The power diagnostic unit is implemented as a hardware circuit. Each functional voltage is divided by precision resistors and compared with a reference voltage to output an overvoltage or undervoltage signal. Furthermore, the power diagnostic unit adjusts the resistance of the precision resistors to set the voltage thresholds for different functions.

[0030] 3. Program monitoring unit

[0031] The program monitoring unit is used to collect the heartbeat signal of the processing unit. Through the configuration and enabling of the processing unit, the program running status of the processing unit is monitored according to the heartbeat signal. If the program running status monitoring result is that the program runs away or the program times out, the operation fault signal is output to the reset logic control unit.

[0032] Preferably, the program monitoring unit is implemented using an independent watchdog, and the independent watchdog is implemented by a dedicated watchdog circuit or CPLD.

[0033] 4. Communication unit

[0034] The communication unit is used to forward post-reset processing control instructions and output behavior control instruction configuration information. The user sends the post-reset processing control instructions and output behavior control instruction configuration information to the communication unit via the maintenance network. The communication unit further forwards the received post-reset processing control instructions and output behavior control instruction configuration information to the processing unit.

[0035] 5. Memory Unit

[0036] The memory unit is bidirectionally connected to the reset logic control unit, allowing the reset logic control unit to both write and read data from the memory unit. The memory unit stores post-reset processing control instructions, output behavior control instruction configuration information, reset source information, and diagnostic information. The memory unit uses nonvolatile memory, which can be either a SPIFlash chip or an EEPROM chip.

[0037] 6. Output control unit

[0038] The output control unit receives the behavior control instruction sent by the reset logic control unit and the control instruction sent by the processing unit, and sends a driving signal to the output unit according to the behavior control instruction and the control instruction.

[0039] 7. Debug interface unit

[0040] The debug interface unit is used to provide an interface for external debug devices to access the processing unit. When the external debug device accesses the processing unit through the debug interface unit, the debug interface unit sends a reset release confirmation message to the reset logic control unit; the debug interface unit selects a program debugging interface or program burning interface supported by the processing unit, such as JTAG.

[0041] 8. Manual reset unit

[0042] The manual reset unit is used to write reset release confirmation information to the reset logic control unit when the user manually releases the reset. Preferably, the manual reset unit is implemented by a light touch button and a debounce circuit.

[0043] This system includes the following four stages when performing reset logic control:

[0044] 1. Reset configuration stage

[0045] The user configures the processing method to be performed after the functional module of the nuclear power plant safety level protection system is reset according to the application situation, including reset hold or restart. The user also configures the safety behavior of the output unit of the functional module (output hold or output disconnection), and inputs the configuration data into the communication unit through the maintenance network. The communication unit then sends it to the processing unit, which forwards it to the reset logic control unit. The reset logic control unit writes the configuration data into the memory unit.

[0046] 2. Reset trigger stage

[0047] The reset logic control unit monitors and receives in real time the operation fault signal output by the program monitoring unit, the voltage abnormality signal output by the power diagnosis unit, and the diagnostic signal output by the processing unit; the reset logic control unit performs logical processing on the received signals, and triggers the processor reset when a fault that affects the system operation occurs. At the same time, it outputs a control signal to the output control unit according to the safety behavior configuration data, and the output control unit drives the output unit to maintain or disconnect the output.

[0048] 3. Reset recording stage

[0049] The reset logic control unit writes the reset source information and the diagnostic data of the processor into the memory unit when a reset occurs.

[0050] 4. Post-reset processing stage

[0051] The reset logic control unit reads the configuration data in the memory unit. If the configuration data is to maintain the reset state, the reset logic control unit will reset and maintain it until it is manually confirmed to be reset and released. If the configuration is to reset and restart, the reset logic control unit will read the previous reset source information and diagnostic information, and judge whether the reset fault is relieved based on each input signal. If the fault still exists, the reset state will be maintained until it is manually confirmed to be reset and released. If the reset fault is relieved, the system will be restarted.

[0052] Among them, manual confirmation means that the user manually releases the reset by pressing a button through the manual reset unit and sends a confirmation signal to the reset logic control unit, or manually releases the reset through the debugging device and sends a confirmation signal to the reset logic control unit through the debugging interface unit.

[0053] Combined with the above four execution stages, the logic processing flow of the logic reset control system of this embodiment is as follows: Figure 3 , specifically:

[0054] When the reset is triggered, enter process 1;

[0055] Processing 1: The reset logic control unit resets the safety output according to the safety behavior configuration, and then enters processing 2;

[0056] Process 2: Reset the logic control unit to reset the record, and then enter process 3;

[0057] Process 3: The reset logic control unit reads the reset configuration data in the memory unit. If the configuration is for the restart state, it enters process 4, otherwise it enters process 7;

[0058] Processing 4: The reset logic control unit reads the last reset source information and diagnostic information, and then enters processing 5;

[0059] Process 5: The reset logic control unit determines whether the reset fault is resolved based on the reset source information and the latest diagnostic information. If the reset fault is resolved, the system is restarted; otherwise, the process proceeds to process 6.

[0060] Processing 6: The reset logic control unit monitors whether there is a human confirmation signal input. If so, the reset logic control unit clears the diagnostic information and restarts the processor. Otherwise, it goes to processing 5.

[0061] Processing seven: The reset logic control unit monitors whether there is a human confirmation signal input. If so, the reset logic control unit clears the diagnostic information and restarts the processor. Otherwise, it repeats processing seven.

[0062] In summary, this embodiment proposes a logic reset control system for a nuclear power plant safety-level protection system. This overcomes the drawback of the system's post-reset safety output behavior and action form, which cannot be flexibly configured based on the application scenario. By manually configuring the system's post-reset actions to maintain the reset and restart states based on application requirements through the maintenance network, and configuring the safety output behavior during the reset period, this system improves system availability in the event of transient recoverable faults and avoids the safety risks associated with frequent system restarts in the event of severe, unrecoverable faults.

[0063] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A logic reset control system for a safety level protection system of a nuclear power plant, characterized in that: The system comprises a reset logic control unit; the reset logic control unit is used to perform logic processing on the received input signal, and if the logic processing result is a fault, output a reset control signal to the processing unit of the system function module; the input signal includes the voltage signal of the system function module, the operation fault signal of the processing unit and the diagnostic signal output by the processing unit; the reset control signal is used to trigger the processing unit to reset; The reset logic control unit is further configured to receive post-reset processing control instructions and output behavior control instruction configuration information configured by the user according to actual application requirements, and send the output behavior control instruction configuration information to the output unit of the system function module; and when the post-reset processing control instruction is a reset hold instruction, reset and hold are performed according to the reset hold instruction until the reset is released after receiving the reset release confirmation information sent by the user; when the post-reset processing control instruction is a reset restart instruction, it is determined whether the fault is released according to the reset source information recorded during the previous reset, the diagnostic information recorded during the previous reset, and the input signal; if so, reset and restart are performed, otherwise reset and hold are performed until the reset is released after receiving the reset release confirmation information; the output behavior control instruction configuration information includes output hold or output disconnection; The input signals of the reset logic control unit are classified item by item according to voltage diagnosis over-limit signal, program monitoring abnormality signal, processing unit self-diagnosis signal, channel diagnosis signal, and communication diagnosis signal, and the smallest sub-item of each classification is assigned different scores according to its impact and importance; The reset logic control unit accumulates the scores of the input signals and clears the integral of the transient fault items according to the working status of the system functional modules, and outputs the reset signal and the safety output according to the actual application requirements in accordance with the accumulated scores.

2. The logic reset control system according to claim 1, characterized in that: It also includes a power supply diagnostic unit; the power supply diagnostic unit is used to set the functional voltage threshold range of the system functional module, and to collect the real-time functional voltage of the system functional module, and compare the real-time functional voltage with the functional voltage threshold. If the real-time functional voltage is greater than the maximum functional voltage threshold, an overvoltage signal is output to the reset logic control unit; if the real-time functional voltage is less than the minimum functional voltage threshold, an undervoltage signal is output to the reset logic control unit.

3. The logic reset control system according to claim 1, characterized in that: It also includes a program monitoring unit; the program monitoring unit is used to collect the heartbeat signal of the processing unit, and monitor the program running status of the processing unit according to the heartbeat signal. If the program running status monitoring result is that the program runs away or the program times out, the operation fault signal is output to the reset logic control unit.

4. The logic reset control system according to claim 3, characterized in that: The program monitoring unit adopts an independent watchdog; the independent watchdog is implemented by a dedicated watchdog circuit or CPLD.

5. The logic reset control system according to claim 1, characterized in that: The reset logic control unit receives the diagnostic signal sent by the processing unit through a digital interface, and the reset logic control unit sends the reset control signal to the processing unit through the digital interface; the digital interface adopts an SPI serial bus or an I2C serial bus.

6. The logic reset control system according to claim 1, characterized in that: It also includes a communication unit; the communication unit is used to forward the post-reset processing control instructions and the output behavior control instruction configuration information; the user sends the post-reset processing control instructions and the output behavior control instruction configuration information to the communication unit through the maintenance network, and then passes them to the processing unit; the communication unit is connected to the processing unit.

7. The logic reset control system according to claim 1, characterized in that: It also includes a memory unit; the memory unit is bidirectionally connected to the reset logic control unit; the memory unit is used to store post-reset processing control instructions, output behavior control instruction configuration information, reset source information and diagnostic information; the memory unit uses a non-volatile memory; the non-volatile memory uses an SPI Flash chip or an EEPROM chip.

8. The logic reset control system according to claim 1, characterized in that: It also includes an output control unit; the output control unit is used to receive the output behavior control instruction configuration information sent by the reset logic control unit and the control instruction sent by the processing unit, and send a drive signal to the output unit according to the output behavior control instruction configuration information and the control instruction.

9. The logic reset control system according to claim 1, characterized in that: The system further includes a debugging interface unit; the debugging interface unit is used to provide an interface for an external debugging device to access the processing unit, and when the external debugging device accesses the processing unit through the debugging interface unit, the debugging interface unit sends the reset release confirmation information to the reset logic control unit; The debugging interface unit selects a program debugging interface or a program burning interface supported by the processing unit.

10. The logic reset control system according to claim 1, characterized in that: It also includes a manual reset unit; the manual reset unit is used to write the reset release confirmation information to the reset logic control unit when the user manually releases the reset.

Images