Protection unit, protection system and protection method for converter valve of flexible DC system

Abstract

The present invention discloses a protection unit, a protection system and a protection method for a converter valve of a flexible direct current system, and belongs to the technical field of converter valve control protection of a flexible direct current transmission system. The protection unit is composed of a first-layer voting topology and a second-layer voting topology. The first-layer voting topology is composed of a redundant module A1, a redundant module B1, a redundant module C1, a voter A, a voter B and a voter C, and the second-layer voting topology is composed of a redundant module A2, a redundant module B2, a redundant module C2 and a voter D. Through this topological design, the protection voting method is divided into a multi-level and multi-module structure, and the complex logic is reduced to a plurality of simple and tiny simple logics, which fundamentally reduces the possibility of multi-bit single-particle flips. Through the time triple-module redundancy method of the redundant module, the single-bit flip generated by the transient state of the single-particle flip is shielded, and the voting error caused by the single-particle flip is solved. The correctness of the voting result is greatly improved through the multi-level redundancy design.

Description

Technical Field

[0001] The present invention belongs to the technical field of converter valve control and protection of a flexible direct current power transmission system, and in particular relates to a protection unit, a protection system and a protection method of a converter valve of a flexible direct current system. Background Art

[0002] Flexible DC technology is a key technology to solve the absorption of new energy, long-distance power transmission and grid security. Flexible DC technology has been widely used in four major fields: grid interconnection, long-distance power transmission, new energy output and medium and low voltage power distribution.

[0003] Flexible DC transmission technology can realize independent control of active and reactive power. It has four-quadrant operation capability, no risk of commutation failure, and independent realization of rectification and inversion. It is gradually replacing traditional DC transmission methods and becoming the core technology in the field of DC transmission.

[0004] In order to ensure the safety of flexible DC system operation, flexible DC system protection devices must be designed. However, due to the complex structure of DC protection equipment, it is necessary to divide it into zones according to the protected equipment and independently configure three sets of protection to ensure the reliability of its protection action, among which the "three out of two" strategy is the most commonly used.

[0005] DC protection generally requires redundant configuration. UHV converter stations adopt a triple configuration of DC protection and a dual configuration of control systems. The “three-out-of-two” protection device realizes data transmission and collection between control and protection systems.

[0006] like Figure 1 As shown, the protection topology of the converter valve of the existing flexible DC system adopts a "three-out-of-two" protection method, using two sets of valve control protection devices to protect two sets of redundant valve control devices respectively. If there is a protection action output, at least two measurement and control units in the protection device need to issue a protection request at the same time.

[0007] The valve control system A and valve control system B have exactly the same topological functions and are redundant to each other. During normal operation, one valve control system is on duty and the other is in standby mode. Taking valve control system A as an example, the valve control system composition is introduced. Valve control system A includes valve control device A and protection device A. Protection device A is composed of measurement and control unit A1, measurement and control unit B1, measurement and control unit C1 and protection unit A. The analog merging unit is an information acquisition device. Its main function is to collect protection function information from the power module and then send this information to the measurement and control units in the two valve control systems. The three measurement and control units parse and process the received protection function information and send it to protection unit A. The "three out of two" protection logic is completed on protection unit A.

[0008] The specific implementation strategies of the "two out of three" protection logic of protection unit A are as follows.

[0009] 1. When the three measurement and control units are normal, if any two of them detect a protection request, the protection unit A outputs a protection instruction to the valve control device A, and the valve control device A starts the protection action.

[0010] 2. When one of the three measurement and control units fails and any one of the remaining two measurement and control units detects a protection request, protection unit A outputs a protection instruction to valve control device A, and valve control device A starts the protection action.

[0011] 3. When two of the three measurement and control units fail and the remaining measurement and control unit detects a protection request, protection unit A outputs a protection instruction to valve control device A, and valve control device A starts the protection action.

[0012] The above is the most commonly used protection logic voting strategy for protection devices in existing valve control systems, which usually has high reliability. However, when flexible DC valve control equipment is built in high-altitude areas of the plateau, a large number of high-speed, high-energy charged particles and plasmas are significantly enhanced. These charged particles or plasmas will cause space radiation effects, and space radiation effects will produce single-particle effects. High-energy particles breaking through the PN junction inside the chip will cause the logic level to flip, resulting in the failure of the existing protection voting strategy. What's more serious is: when the valve-controlled protection device is unable to trip the output or the power unit is locked due to the failure of the protection voting strategy, the converter valve will work in an unprotected state, which will be more dangerous.

[0013] Specifically, the existing protection voting strategy still has the following shortcomings.

[0014] First, the protection voting strategy of the protection device does not have a high reliability design. The voter itself may encounter space radiation effects, which may cause single particle flips and cause errors in the protection voting strategy results.

[0015] Second, the protection device actually implements the protection voting strategy on the FPGA chip on the protection board, and the large-area and high-complexity FPGA design has a high probability of multiple bits flipping at the same time, causing errors in the protection voting strategy results. Summary of the invention

[0016] In order to overcome the drawbacks of existing valve-controlled protection devices that result in erroneous protection voting strategies due to single-particle flipping and simultaneous flipping of multiple bits in high altitude areas, the present invention provides a protection unit, a protection system and a protection method for a converter valve in a flexible DC system.

[0017] In order to achieve the above object, the present invention adopts the following technical solution: In a first aspect, the present invention provides a protection unit for a converter valve of a flexible DC system, comprising a first-layer voting structure and a second-layer voting structure, wherein the first-layer voting structure comprises three first redundant modules and three first voters, and the second-layer voting structure comprises three second redundant modules and a second voter; The input ends of the three first redundant modules are respectively connected to the three measurement and control units, and the output ends are all connected to the input ends of the three first voters. The output ends of the three first voters are respectively connected to the input ends of the three second redundant modules, and the output ends of the three second redundant modules are all connected to the input ends of the second voters. The first redundant module and the second redundant module have the same structure. The first redundant module includes a first D flip-flop. The data input port of the first D flip-flop is used to receive an input signal, and the output port is connected to the data input port of the second D flip-flop. The output port of the second D flip-flop is connected to the data input port of the third D flip-flop. The output ports of the first D flip-flop, the second D flip-flop and the third D flip-flop are all connected to the input end of the third voter.

[0018] Furthermore, the first voter, the second voter and the third voter adopt the same voting logic.

[0019] Furthermore, the first voter includes three first NAND gates, each of which has two input ends, the two input ends are respectively connected to two signals, and among any two first NAND gates, one and only one input end is connected to the same signal; the output ends of the three first NAND gates are all connected to the input ends of the second NAND gate.

[0020] In a second aspect, the present invention provides a protection system for a converter valve of a flexible DC system, comprising an analog merging unit, wherein an output end of the analog merging unit is connected to input ends of two valve control systems; The valve control system comprises three measurement and control units and the protection unit described in claim 1, the output ends of the three measurement and control units are connected to the input end of the protection unit, and the protection unit interacts with the valve control device in a bidirectional manner.

[0021] Furthermore, during operation, one set of valve control systems is in a duty state, and the other set of valve control systems is in a standby state.

[0022] In a third aspect, the present invention provides a protection method for a protection unit of a converter valve of a flexible DC system, characterized in that it comprises: After the analog merging unit collects the protection function information from the power module, the protection function information is sent to all the measurement and control units in any valve control system; The measurement and control unit sends a protection request signal to the protection unit based on the received protection function information, and the protection unit sends a protection instruction to the valve control device based on the received protection request signal, which specifically includes: The three measurement and control units respectively send protection request signals to the three first redundant modules. The three first redundant modules generate three first output signals based on the protection request signals and the clock signals. The three first output signals are used as inputs of the three first voters. The three first voters output three first-layer voting signals. The three first-layer voting signals are used as input signals of the three second redundant modules respectively. The three second redundant modules generate three second output signals based on the input signals and the clock signals. The second voters output the final voting results based on the three second output signals.

[0023] Furthermore, the three first redundant modules respectively generate three first output signals based on the protection request signal and the clock signal: the protection request signal is delayed at least three times for different times to obtain at least three delayed signals, and all the delayed signals are used as inputs of the third voter, and the third voter outputs the voting results based on the input.

[0024] Further, the three first redundant modules respectively generate three first output signals based on the protection request signal and the clock signal, including: The protection request signal IN is input into the D flip-flop DFF1, the clock signal is input into the D flip-flop DFF1, the D flip-flop DFF2 and the D flip-flop DFF3, the D flip-flop DFF1 outputs the signal D1 when the clock signal is at a high level; then, the signal D1 is input into the D flip-flop DFF2, the D flip-flop DFF2 outputs the signal D2 when the clock signal is at a high level; then, the signal D2 is input into the D flip-flop DFF3, the D flip-flop DFF3 outputs the signal D3 when the clock signal is at a high level; finally, the signals D1, D2 and D3 are all input into the third voter for voting to obtain the voting result.

[0025] Furthermore, when the signal D1, the signal D2 and the signal D3 are all input into the third voter for voting, the voting logic is: when any two of the signal D1, the signal D2 and the signal D3 are true, the voting result is true.

[0026] Furthermore, the third voting machine outputs the voting result according to the principle of minority obeys majority.

[0027] Compared with the prior art, the present invention has at least the following beneficial technical effects: The redundant module provided by the present invention adopts a time triple-module redundancy method and provides three-level triggers to store data in a time-sharing manner. If a single-particle flip-flop occurs at the same time, the result of one and only one level of trigger is wrong, while the storage results of the remaining levels are correct. Therefore, the number of correct inputs to the voter is greater than the number of transient errors. Therefore, the error can be shielded after the voter outputs, and the final output result is still correct. This design fundamentally avoids the possibility of single-particle flip-flops causing data to be sent incorrectly during the storage process. It avoids voting errors caused by single-particle flips, and greatly improves the correctness of voting results through multi-level redundant design.

[0028] The present invention proposes a hierarchical three-module redundancy design, which divides the complex logic into layers, making it functionally independent sub-modules, and then independently performs three-module redundancy on each sub-module, so that the overall three-module redundancy is transformed into a hierarchical three-module redundancy with a hierarchical structure, and the levels are isolated by voters for fault tolerance. The possibility of multi-bit single-particle flips in small-area, low-complexity logic parts is greatly reduced, and when a single-particle flip occurs in a level, the voter at this level can shield its erroneous logic without affecting the reliability of the overall FPGA design. The design can resist independent multi-bit single-particle flips and greatly improve the reliability of the protection system.

[0029] Furthermore, the present invention provides multiple redundancies of redundant modules and voters based on the principle of "the minority is subject to the majority", which further improves the accuracy of data storage between various levels and modules and the reliability of each voter from the perspective of probability theory. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is the "three out of two" protection topology of the converter valve of the existing flexible DC system; Figure 2 To protect the unit hierarchy and module schematics; Figure 3 This is the internal logic diagram of the redundant module; Figure 4 This is the internal logic diagram of the voting machine; Figure 5 is the Karnaugh map. DETAILED DESCRIPTION

[0031] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0032] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that when an element is referred to as being "disposed on" another element, it may be directly on the other element or there may be another element centered thereon. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be another element centered thereon at the same time. The terms "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inside", "outside", etc. used herein indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0035] The present invention greatly improves the high reliability operation of the converter valve protection device in high altitude plateau areas by means of shielding particle flipping, multi-particle flipping resistance and cascade redundant voting methods.

[0036] 1. Protection unit topology design Since the possibility of multiple bits flipping at the same time increases when using a large-area, high-complexity FPGA design, it is necessary to divide the complex logic into layers when reliability design is required, so that it is functionally independent sub-modules, and then perform three-module redundancy independently on each sub-module, so that the overall three-module redundancy is transformed into a hierarchical layered three-module redundancy with a hierarchical structure, and the layers are isolated by the voter for fault tolerance. The possibility of multi-bit single-particle flipping in the logic part with small area and low complexity is greatly reduced, and when a single-particle flip occurs in a layer, the voter at this layer can shield its erroneous logic and does not affect the overall reliability of the FPGA. Therefore, the layered three-module redundancy design can resist independent multi-bit single-particle flips and greatly improve the reliability of the system. If each layer is divided independently so that each independent layer has the same reliability, the entire system can achieve the highest reliability.

[0037] In order to reduce the possibility of multi-bit single event upset and maximize the reliability of the protection unit, the protection unit is divided into Figure 3 The protection unit as a whole consists of two major parts: the first-layer voting topology and the second-layer voting topology. The first-layer voting topology consists of six parts: redundant module A1, redundant module B1, redundant module C1, voter A, voter B and voter C. The second-layer voting topology consists of four parts: redundant module A2, redundant module B2, redundant module C2 and voter D. Figure 2 The detailed internal logic of all redundant modules is as follows: Figure 3 As shown, Figure 2 and Figure 3 The detailed internal logic of all the voting devices is as follows Figure 4 As shown. Through this topological design, the protection voting method is divided into a multi-level and multi-module structure, and the complex logic is reduced to multiple simple and tiny simple logics, which fundamentally reduces the possibility of multi-bit single-particle flip.

[0038] In order to further improve the reliability of the protection unit, based on the principle of "the minority obeys the majority", the protection topology of the present invention is designed with multi-level redundancy, and the specific implementation method is as follows: 1) The input signal is redundant three times, data A_IN from measurement and control unit A, data B_IN from measurement and control unit B, and data C_IN from measurement and control unit C. Theoretically, these three data have the same value. In order to prevent measurement and control unit acquisition errors, three redundant input data are used to improve the reliability of input data.

[0039] 2) The redundant module is used three times in the first-layer voting structure and the second-layer voting structure. This redundant module is used as a time triple-module redundancy method to prevent single-particle flips in the input data during storage and cause data errors. Through the time-sharing voting method of the redundant module, the correctness and reliability of data storage are greatly improved.

[0040] 3) The voting machine performs redundant voting three times in the first-level voting structure (voter A, voter B, voter C), and the voting results (A_D, B_D, C_D) provide three redundant inputs for the second-level voting structure.

[0041] 4) The voter D in the second-layer voting structure performs a final redundant vote on the voting results (A_D, B_D, C_D) in the first-layer voting structure, and finally outputs a high-reliability final voting result D_OUT.

[0042] 2. Redundant module design The redundant module is a time triple-module redundant method, its internal ( Figure 3 ) includes D flip-flops DFF1, D flip-flops DFF2, D flip-flops DFF3 and voter E. For FPGA, if the pulse voltage generated by the single-particle flip transient occurs at the clock sampling moment, it may cause a race hazard, generate a burr, and propagate in the logic circuit, thereby causing an error. This error can be shielded by the redundant module, avoiding the voting error caused by the single-particle flip.

[0043] The redundancy module considers the time sequence of error flip transmission. The same input DIN is sequentially stored three times through three D flip-flops (DFF1, DFF2 and DFF3) under the triggering of the system clock CLK, and the output data is D1, D2 and D3. If a single particle flip is sent at the same time, the result of one and only one level of flip-flops is wrong, while the stored results of the remaining levels are correct. Therefore, the number of correct inputs of the voter is greater than the number of transient errors, and the error can be shielded after the voter output. Its expression is DOUT = (D1&D2) | (D1&D3) | (D2&D3). It can be seen that this redundancy module can effectively solve the problem of single-bit errors in data caused by single particle flips.

[0044] Redundant modules require timing control to prevent transient flip errors during transmission and to produce a certain clock delay on the output results.

[0045] 3. Voting machine design Figure 4The voting machine shown in the figure is composed of three two-input NAND gates and one three-input NAND gate. It votes on the final output result based on the principle of "the minority obeys the majority". The logical expression of the voting machine is Y = X1X2 + X1X3 + X2X3. From the logical expression, it can be seen that any error in any of the three input data X1, X2 and X3 will not affect the correctness of the final result Y. The corresponding truth table is shown in Table 1, and the Karnaugh map is shown in Figure 5 shown.

[0046] Table 1

[0047] The following specific embodiments need to be explained that these embodiments are preferred examples of the present invention and are used for those skilled in the art to understand the present invention, but the present invention is not limited to these embodiments.

[0048] Example 1 Reference Figure 2 , this embodiment provides a protection unit for a converter valve of a flexible DC system, including a first-layer voting structure and a second-layer voting structure. The first-layer voting structure includes a redundant module A1, a redundant module B1, a redundant module C1, a voter A, a voter B, and a voter C; the second-layer voting structure includes a redundant module A2, a redundant module B2, a redundant module C2, and a voter D; the input ends of the redundant modules A1, B1, and C1 are respectively connected to the output ends of the measurement and control unit A, the measurement and control unit B, and the measurement and control unit C, and the output ends are all connected to the input ends of the voter A, the voter B, and the voter C; the output ends of the voter A, the voter B, and the voter C are respectively connected to the input ends of the redundant modules A2, the redundant modules B2, and the redundant modules C2, and the output ends of the redundant modules A2, the redundant modules B2, and the redundant modules C2 are all connected to the input end of the voter D.

[0049] The redundant module A1, the redundant module B1, the redundant module C1, the redundant module A2, the redundant module B2 and the redundant module C2 have the same structure, and the redundant module A1 is taken as an example for description.

[0050] Reference Figure 3 The redundant module A1 includes a D flip-flop DFF1, a data input port of the D flip-flop DFF1 is used to receive an input signal, an output port is connected to a data input port of the D flip-flop DFF2, an output port of the D flip-flop DFF1 is connected to a data input port of the D flip-flop DFF1, and output ports of the D flip-flops DFF1, D flip-flops DFF1 and D flip-flops DFF3 are all connected to an input end of the voter E.

[0051] Example 2 This embodiment provides a protection system for a converter valve of a flexible DC system, including an analog merging unit, wherein an output end of the analog merging unit is connected to an input end of a valve control system A and an input end of a valve control system B; The valve control system A includes a protection device A and a valve control device A. The protection device A includes a measurement and control unit A1, a measurement and control unit B1, a measurement and control unit C1 and a protection unit A. The output ends of the measurement and control unit A1, the measurement and control unit B1 and the measurement and control unit C1 are all connected to the input end of the protection unit A. The protection unit A interacts with the valve control device A in a bidirectional manner.

[0052] The valve control system B includes a protection device B and a valve control device B. The protection device B includes a measurement and control unit A2, a measurement and control unit B2, a measurement and control unit C2 and a protection unit B. The output ends of the measurement and control unit A2, the measurement and control unit B2 and the measurement and control unit C2 are all connected to the input end of the protection unit B. The protection unit B interacts with the valve control device B in a bidirectional manner.

[0053] The protection unit A and the protection unit B both adopt the protection unit provided in Example 1.

[0054] Example 3 This embodiment provides a protection method for a converter valve of a flexible DC system, based on the protection system provided in Embodiment 2, including the following steps: After the analog merging unit collects the protection function information from the power module, the protection function information is sent to the measurement and control unit A1, the measurement and control unit B1, and the measurement and control unit C1; The measurement and control unit A1, the measurement and control unit B1, and the measurement and control unit C1 send protection request signals to the redundant module A1, the redundant module B1, and the redundant module C1 respectively based on the received protection function information. The redundant modules A1, the redundant modules B1, and the redundant modules C1 respectively generate three output signals A1_D, B1_D, and C1_D based on the protection request signal and the clock signal. A1_D, B1_D, and C1_D serve as inputs of the voter A, the voter B, and the voter C. The voter A, the voter B, and the voter C respectively output three A layer of voting signals A_D, B_D and C_D, the first layer of voting signals A_D, B_D and C_D are used as input signals of redundant module A2, redundant module B2 and redundant module C2 respectively, redundant module A2, redundant module B2 and redundant module C2 generate three second output signals A2_D, B2_D and C2_D based on the first layer of voting signals A_D, B_D, C_D and the clock signal, the second output signals A2_D, B2_D and C2_D are input into the voter D, and the voter D outputs the final voting result.

[0055] The internal logics of the redundant modules A1, B1, C1, A2, B2 and C2 are the same, and the internal logic of the redundant module A1 is taken as an example for detailed description.

[0056] The signal A_IN input to the redundant module is delayed three times at different times to obtain the signals D1, D2 and D3. The signals D1, D2 and D3 are used as the inputs of the voter E, and the voter E outputs the voting result according to the principle of minority obeys majority.

[0057] The term "consisting of" describing a combination shall include the identified elements, ingredients, parts or steps and other elements, ingredients, parts or steps that do not substantially affect the basic novel characteristics of the combination. The use of the terms "comprising" or "including" to describe a combination of elements, ingredients, parts or steps herein also contemplates embodiments that consist essentially of these elements, ingredients, parts or steps. By using the term "may", it is intended to illustrate that any of the attributes described that "may" be included are optional.

[0058] Multiple elements, ingredients, parts or steps can be provided by a single integrated element, ingredient, part or step. Alternatively, a single integrated element, ingredient, part or step can be divided into separate multiple elements, ingredients, parts or steps. The disclosure "one" or "an" used to describe an element, ingredient, part or step is not intended to exclude other elements, ingredients, parts or steps.

[0059] It should be understood that the above description is for illustration and not for limitation. Many embodiments and many applications beyond the examples provided will be apparent to those skilled in the art upon reading the above description. Therefore, the scope of the present teachings should not be determined with reference to the above description, but rather with reference to the foregoing claims and the full scope of equivalents to which such claims are entitled. For the purpose of comprehensiveness, all articles and references, including disclosures of patent applications and publications, are incorporated herein by reference. The omission of any aspect of the subject matter disclosed herein in the foregoing claims is not intended to be a waiver of such subject matter, nor should it be considered that the applicant has not considered such subject matter to be part of the disclosed inventive subject matter.

Claims

1. A protection unit for a converter valve of a flexible DC system, characterized in that: It includes a first-layer voting structure and a second-layer voting structure, wherein the first-layer voting structure includes three first redundant modules and three first voters, and the second-layer voting structure includes three second redundant modules and a second voter; The input ends of the three first redundant modules are respectively connected to the three measurement and control units, and the output ends are all connected to the input ends of the three first voters. The output ends of the three first voters are respectively connected to the input ends of the three second redundant modules, and the output ends of the three second redundant modules are all connected to the input ends of the second voters. The first redundant module and the second redundant module have the same structure. The first redundant module includes a first D flip-flop. The data input port of the first D flip-flop is used to receive an input signal, and the output port is connected to the data input port of the second D flip-flop. The output port of the second D flip-flop is connected to the data input port of the third D flip-flop. The output ports of the first D flip-flop, the second D flip-flop and the third D flip-flop are all connected to the input end of the third voter.

2. The protection unit for the converter valve of the flexible DC system according to claim 1, characterized in that: The first voter, the second voter and the third voter adopt the same voting logic.

3. The protection unit for the converter valve of the flexible DC system according to claim 1 or 2, characterized in that: The first voter includes three first NAND gates, each of which has two input ends, the two input ends are respectively connected to two signals, and among any two first NAND gates, one and only one input end is connected to the same signal; the output ends of the three first NAND gates are all connected to the input end of the second NAND gate.

4. A protection system for a converter valve of a flexible DC system, characterized in that: It includes an analog merging unit, the output end of which is connected to the input ends of two valve control systems; The valve control system comprises three measurement and control units and the protection unit described in claim 1, the output ends of the three measurement and control units are connected to the input end of the protection unit, and the protection unit interacts with the valve control device in a bidirectional manner.

5. The protection system for converter valves in a flexible DC system according to claim 4, characterized in that: During operation, one valve control system is in duty status and the other valve control system is in standby status.

6. The protection method of the protection unit of the flexible DC system converter valve according to claim 4 is characterized in that: include: After the analog merging unit collects the protection function information from the power module, the protection function information is sent to all the measurement and control units in any valve control system; The measurement and control unit sends a protection request signal to the protection unit based on the received protection function information, and the protection unit sends a protection instruction to the valve control device based on the received protection request signal, which specifically includes: The three measurement and control units respectively send protection request signals to the three first redundant modules. The three first redundant modules generate three first output signals based on the protection request signals and the clock signals. The three first output signals are used as inputs of the three first voters. The three first voters output three first-layer voting signals. The three first-layer voting signals are used as input signals of the three second redundant modules respectively. The three second redundant modules generate three second output signals based on the input signals and the clock signals. The second voters output the final voting results based on the three second output signals.

7. The protection method according to claim 6, characterized in that: The three first redundant modules respectively generate three first output signals based on the protection request signal and the clock signal: the protection request signal is delayed at least three times for different times to obtain at least three delayed signals, and all the delayed signals are used as inputs of the third voter, and the third voter outputs the voting results based on the input.

8. The protection method according to claim 6, characterized in that: The three first redundancy modules respectively generate three first output signals based on the protection request signal and the clock signal, including: The protection request signal IN is input into the D flip-flop DFF1, the clock signal is input into the D flip-flop DFF1, the D flip-flop DFF2 and the D flip-flop DFF3, the D flip-flop DFF1 outputs the signal D1 when the clock signal is at a high level; then, the signal D1 is input into the D flip-flop DFF2, the D flip-flop DFF2 outputs the signal D2 when the clock signal is at a high level; then, the signal D2 is input into the D flip-flop DFF3, the D flip-flop DFF3 outputs the signal D3 when the clock signal is at a high level; finally, the signals D1, D2 and D3 are all input into the third voter for voting to obtain the voting result.

9. The protection method according to claim 8, characterized in that: The voting logic when the signal D1, the signal D2 and the signal D3 are all input into the third voter for voting is: when any two of the signal D1, the signal D2 and the signal D3 are true, the voting result is true.

10. The protection method according to claim 7, characterized in that: The third voting device outputs the voting result according to the principle of majority rule.

Images