Steam turbine control system and communication fault protection method and module thereof

Abstract

The invention discloses a steam turbine control system and a communication fault protection method and module thereof, and the communication fault protection method comprises the steps: monitoring a communication signal between a processor and a previous processor, and judging whether a communication fault exists between the processor and the previous processor or not according to the communication signal, the steam turbine control system comprises a plurality of processors in chain communication connection. When a communication fault exists, a TAB control signal output by the processor is switched to a safety value, and the safety value is larger than zero; and when the communication fault does not exist, outputting the TAB control signal output by the former processor to the latter processor. According to the technical scheme, the tripping hidden danger that the TAB control signal returns to zero due to off-network of the processor can be thoroughly eliminated, the operation safety of a unit is improved, and only the process is stopped and the original system control logic is not damaged if a communication fault occurs in the rush-to-turn stage.

Description

Technical Field

[0001] This application relates to the field of automation control technology, and in particular to a steam turbine control system and its communication fault protection method and module. Background Technology

[0002] In the generator units of large nuclear power plants or thermal power plants, the TAB (Turbine Actuation Block) control logic is the key control logic in the turbine start-up process, used for the opening and closing control of power regulating valves and trip protection shut-off valves.

[0003] In a steam turbine control system, the TAB control logic involves multiple automated processors that communicate in a chain network in a specific order. During normal operation, the first processor generates a TAB control signal, which is then transmitted sequentially to the next processor in the chain network until the last processor outputs the final TAB control command. However, if one processor fails and disconnects from the network during transmission, the TAB control signal transmitted through the network will jump to 0, resulting in a zero TAB control command. This zero TAB control command will be activated by the subsequent minimum value selection logic module, causing the turbine regulating valve to close and ultimately triggering a turbine trip, resulting in significant economic losses. Summary of the Invention

[0004] The technical problem to be solved by this application is to provide a steam turbine control system and its communication fault protection method and module, which address the technical defects of existing technologies where communication failures of the processor cause steam turbine tripping.

[0005] The technical solution adopted by this application to solve its technical problem is: constructing a communication fault protection method for a steam turbine control system, applied to the processor of the steam turbine control system, the communication fault protection method comprising: Monitoring and judgment steps: Monitor the communication signal between this processor and the previous processor, and determine whether there is a communication fault between this processor and the previous processor based on the communication signal. The turbine control system includes multiple processors connected in a chain. First control step: When a communication failure occurs, the TAB control signal output by this processor is switched to a safe value, wherein the safe value is greater than zero; Second control step: If there is no communication failure, output the TAB control signal from the previous processor to the next processor.

[0006] Optionally, determining whether there is a communication failure between the current processor and the previous processor based on the communication signal includes: Based on the communication signal, determine whether the communication connection between this processor and the previous processor has been broken; When the communication connection is disconnected, determine whether the duration of the disconnection is greater than a first preset time; If the time exceeds the first preset time, it is determined that there is a communication failure between the current processor and the previous processor.

[0007] Optionally, the second control step includes: If there is no communication failure, wait for a second preset time before outputting the TAB control signal from the previous processor to the next processor.

[0008] Optionally, monitoring the communication signals between this processor and the previous processor includes: Monitor the life signals transmitted between this processor and the previous processor; or, Monitor the communication messages transmitted between this processor and the previous processor, and calculate the packet loss rate.

[0009] Optionally, switching the TAB control signal output by the processor to a safe value includes: Switch the TAB control signal output by this processor to 100%; or, Switch the TAB control signal output by this processor to the control value cached before the communication failure occurred.

[0010] This invention also constructs a communication fault protection module for a steam turbine control system, applied in the processor of the steam turbine control system, the communication fault protection module comprising: The monitoring and judgment unit is used to monitor the communication signal between the current processor and the previous processor, and to determine whether there is a communication fault between the current processor and the previous processor based on the communication signal. The turbine control system includes multiple processors connected in a chain. The control unit is configured to output the TAB control signal from the previous processor to the next processor when there is no communication failure; and to switch the TAB control signal output by this processor to a safe value when there is a communication failure, wherein the safe value is greater than zero.

[0011] Optionally, the monitoring and judgment unit includes: a NOT gate, a first power-on delay device, a second power-on delay device, an OR gate, and a latch, wherein the input terminal of the NOT gate and the input terminal of the first power-on delay device are respectively connected to the communication signal, the output terminal of the NOT gate is connected to the input terminal of the second power-on delay device, the output terminal of the second power-on delay device is connected to the first input terminal of the OR gate, the output terminal of the first power-on delay device is connected to the second input terminal of the OR gate, the output terminal of the OR gate is connected to the input terminal of the latch, and the output terminal of the latch outputs a communication fault judgment signal.

[0012] Optionally, the monitoring and judgment module further includes a power-off delay device connected between the output of the OR gate and the input of the latch.

[0013] Optionally, the control unit includes a switch, wherein the first input terminal of the switch receives the TAB control signal output by the previous processor, the second input terminal of the switch receives the safety value, and the control terminal of the switch receives the communication fault judgment signal.

[0014] The present invention also constructs a steam turbine control system, including multiple processors connected in a chain, wherein the processors include the communication fault protection module described above.

[0015] Optionally, the last processor is a processor with a communication failure self-holding function; The processor that is communicatively connected to the last processor includes the communication fault protection module as described in any one of claims 6-8.

[0016] The technical solution of this application has the following beneficial effects: 1. Anti-shutdown: It can completely eliminate the potential for shutdown caused by the processor going offline and the TAB control signal returning to zero, thus improving the safety of unit operation; 2. No functional impact: If a communication failure occurs during the rollback phase, the process will only be stopped, without disrupting the original system control logic; 3. Strong compatibility: The processor does not require hardware replacement and can be adapted to the renovation of existing units. Attached Figure Description

[0017] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a flowchart of a communication fault protection method for a steam turbine control system according to an embodiment of the present invention; Figure 2 This is a logic structure diagram of a steam turbine control system in one embodiment of the present invention; Figure 3 This is a partial logic structure diagram of the processor in one embodiment of the present invention; Figure 4 This is a partial logic structure diagram of the processor in one embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Figure 1 This is a flowchart of a communication fault protection method for a steam turbine control system according to an embodiment of the present invention. The communication fault protection method of this embodiment is applied to a processor in the steam turbine control system, and the steam turbine control system includes multiple processors connected in a chain, for example, three processors. The communication fault protection method of this embodiment includes the following steps: Monitoring and Judgment Step S10: Monitor the communication signal between this processor and the previous processor, and determine whether there is a communication fault between this processor and the previous processor based on the communication signal. If yes, execute the first control step S20; if no, execute the second control step S30. First control step S20: Switch the TAB control signal output by this processor to a safe value, wherein the safe value is greater than zero; Second control step S30: Output the TAB control signal output by the previous processor to the next processor.

[0020] In this embodiment, for a processor in a chain-like communication network, it determines whether there is a communication failure between itself and the preceding processor by monitoring its own communication signals; that is, it determines whether it has disconnected from the network due to a failure. Furthermore, when a communication failure exists, the processor switches its output TAB control signal to a safe value (greater than zero), i.e., it outputs a non-zero TAB control signal to the following processor; when there is no communication failure (fault recovery), it directly outputs the TAB control signal from the preceding processor to the following processor, i.e., it restores the normal tracking function of the TAB control signal. Therefore, the technical solution of this embodiment has the following beneficial effects: 1. Anti-shutdown: It can completely eliminate the potential for shutdown caused by the processor going offline and the TAB control signal returning to zero, thus improving the safety of unit operation; 2. No functional impact: If a communication failure occurs during the rollback phase, the process will only be stopped, without disrupting the original system control logic; 3. Strong compatibility: The processor does not require hardware replacement and can be adapted to the renovation of existing units.

[0021] Further, in an optional embodiment, the monitoring and judgment step S10, which monitors the communication signals between the current processor and the previous processor, includes monitoring the life signal transmitted between the current processor and the previous processor. In this embodiment, regarding the life signal, it should be noted that when communication is normal, the life signal is a high-low level switching signal sent between two adjacent processors, and includes a timestamp and a status code; when communication fails, the life signal is a constant low level signal. Therefore, the presence of a communication failure between the two processors can be determined by monitoring the life signal transmitted between them.

[0022] In another optional embodiment, the monitoring and judgment step S10 monitors the communication signals between the current processor and the previous processor, including: monitoring the communication messages transmitted between the current processor and the previous processor, and calculating the packet loss rate. In this embodiment, when communication is normal, the two processors transmit communication messages normally with a low packet loss rate; however, when communication fails, the communication messages sent by one processor cannot reach the other processor. Therefore, the packet loss rate can be calculated to determine whether there is a communication failure between the two processors. For example, if the packet loss rate is greater than a set value (e.g., 50%) within 1 second, it is considered a communication failure; otherwise, communication is considered normal. Compared with the judgment method relying on vital signs, this embodiment of communication failure judgment requires the addition of a message statistics module and a packet loss rate calculation module, so it is suitable for scenarios where network message transmission is stable and the packet loss rate can be accurately calculated.

[0023] Furthermore, since this method of judging communication failures requires high real-time computing power for network bandwidth, it may lead to misjudgment when there is instantaneous network congestion (the packet loss rate temporarily exceeds the threshold). Therefore, the determination step of packet loss duration can be further increased. For example, a communication failure can only be triggered if the packet loss rate continuously exceeds the threshold within the first time period (e.g., 2 seconds).

[0024] Further, in an optional embodiment, the communication signal is a life signal, and the monitoring and judgment step S10, which determines whether there is a communication failure between the current processor and the previous processor based on the communication signal, includes: Based on the communication signal, determine whether the communication connection between this processor and the previous processor has been broken; When the communication connection is disconnected, it is determined whether the duration of the disconnection is greater than a first preset time, such as 10 seconds. If the time exceeds the first preset time, it is determined that there is a communication failure between the current processor and the previous processor.

[0025] In this embodiment, when monitoring the life signals of the current processor and the previous processor, if it is determined that the communication connection is disconnected based on the life signal, it is also determined whether the duration of the disconnection is greater than a first preset time. If so, it is confirmed that there is a communication fault, which can ensure the accuracy of fault judgment.

[0026] Regarding the above embodiments, it should also be noted that if the communication messages between this processor and the previous processor are monitored, and the existence of a communication failure is determined based on the packet loss rate, the above-mentioned delay judgment step is not required.

[0027] Further, in an optional embodiment, the second control step S20 includes: when there is no communication failure, waiting for a second preset time before outputting the TAB control signal from the previous processor to the next processor, wherein the second preset time is, for example, 20 seconds. In this embodiment, the delay can eliminate the false judgment of short-term disconnection of communication connection, thereby preventing false triggering caused by fault signal fluctuations. In this embodiment, the delay of the second preset time can prevent false triggering caused by short-term fluctuations in vital signals, improving the accuracy of fault judgment.

[0028] Furthermore, in an optional embodiment, the first control step S20, switching the TAB control signal output by the processor to a safe value, includes: switching the TAB control signal output by the processor to 100%. In this embodiment, for a processor experiencing a grid disconnection fault, its output TAB control signal can be stably maintained at 100%. Thus, the TAB control command output by the last processor is not 0. At this time, the unit maintains grid-connected operation, successfully avoiding a trip.

[0029] In another optional embodiment, the first control step S20, switching the TAB control signal output by the processor to a safe value, includes: switching the TAB control signal output by the processor to a control value cached before the communication failure occurred. In this embodiment, when a failure occurs during the rollover phase, the output TAB control signal remains at the last valid control value before the failure. Compared to switching to 100%, this method avoids the TAB control signal from abruptly changing from the control value before the failure to 100%, thereby making the fault tolerance during the rollover phase more accurate.

[0030] Regarding the above embodiments, it should also be noted that, since a cache unit needs to be added to the processor to cache the TAB control value before the fault in real time, it is more suitable for scenarios where the TAB control signal needs to be accurately maintained during the restart phase. In addition, the additional cache unit increases program complexity, and the TAB control value before the fault needs to be verified to determine whether it affects restart safety. If it is safe, the TAB control value can be used; otherwise, it is not.

[0031] This invention also constructs a communication fault protection module for a steam turbine control system. This module is applied to the processor of the steam turbine control system and includes a monitoring and judgment unit and a control unit. The monitoring and judgment unit monitors the communication signals between the current processor and the preceding processor, and determines whether a communication fault exists between them based on the communication signals. The steam turbine control system includes multiple processors connected in a chain. The control unit, when no communication fault exists, outputs the TAB control signal from the preceding processor to the next processor; when a communication fault exists, it switches the TAB control signal output by the current processor to a safe value, wherein the safe value is greater than zero.

[0032] The present invention also constructs a steam turbine control system, which includes multiple processors connected in a chain communication manner, and the processors include the communication fault protection module described above.

[0033] Furthermore, in an optional embodiment, for the multiple processors of the turbine control system, the last processor is a processor with a communication fault self-holding function, such as the high-end processor of the FM458; the processor communicatively connected to the last processor is the aforementioned processor with communication fault protection function. Of course, in other embodiments, the other processors besides the last two processors may also include the communication fault protection module described above.

[0034] In this embodiment, the last processor in the chain-like communication network employs a high-end controller (such as the FM458) with communication fault self-holding function. This ensures the stability of the TAB control command when the processor goes offline, effectively preventing turbine tripping caused by the TAB control command returning to zero. Simultaneously, when other processors experience offline faults, the processors connected to the last processor have communication fault protection modules, completely eliminating the potential for turbine tripping caused by the TAB control signal returning to zero during transmission due to offline faults in other processors.

[0035] Figure 2This is a logical structure diagram of a steam turbine control system in one embodiment of the present invention. The steam turbine control system in this embodiment includes a third processor 13, a second processor 12, and a first processor 11 connected in a chain. The first processor 11 (the last processor) is a processor with a communication fault self-holding function, such as a high-end processor using FM458. The second processor 12 (the processor connected in communication with the last processor) includes the communication fault protection module described above.

[0036] In this embodiment, if all three processors 11, 12, and 13 are not offline, the third processor 13 generates a TAB control signal based on the unit's current operating information and transmits it to the second processor 12 via network communication. The second processor 12, upon receiving the TAB control signal, then transmits it to the first processor 11 via network communication. Finally, the first processor 11 outputs the final TAB control command. This TAB control command, along with the turbine flow controller calculation command, turbine pressure controller calculation command, and speed and load controller calculation command, is sent to the small selection logic module for logical operations, ultimately generating the GRE control valve's on / off control command.

[0037] If the third processor 13 goes offline, meaning there is a communication failure between the second processor 12 and the third processor 13, the monitoring and judgment unit in the second processor 12 can determine that a communication failure exists based on the communication signal between it and the third processor 13. Then, the control unit in the second processor 12 outputs a TAB control signal with a safe value to the first processor 11. Finally, the first processor 11 outputs a TAB control command with a safe value. At this time, the small selection block logic module does not operate, the turbine operates stably, and there is no risk of turbine tripping.

[0038] If the second processor 12 goes offline, meaning there is a communication failure between the first processor 11 and the second processor 12, then since the first processor 12 is a processor with a communication failure self-holding function, it automatically retains the last TAB control signal value received from the second processor 12 (100% after grid connection) and outputs it to the small selection block logic module. At this time, the small selection block logic module does not operate, the turbine operates stably, and there is no risk of turbine tripping.

[0039] Furthermore, combined Figures 2 to 4 In the second processor 12, the communication fault protection module includes a monitoring and judgment unit 121 and a control unit 122.

[0040] like Figure 3As shown, the monitoring and judgment unit 121 includes: a NOT gate 1211, a first power-on delay device 1212, a second power-on delay device 1213, an OR gate 1214, a power-off delay device 1215, and a latch 1216. The inputs of the NOT gate 1211 and the first power-on delay device 1212 are respectively connected to a life signal (XT51). The output of the NOT gate 1211 is connected to the input of the second power-on delay device 1213. The output of the second power-on delay device 1213 is connected to the first input of the OR gate 1214. The output of the first power-on delay device 1212 is connected to the second input of the OR gate 1214. The output of the OR gate 1214 is connected to the input of the power-off delay device 1215. The output of the power-off delay device 1215 is connected to the input of the latch 1216. The output of the latch 1216 outputs a communication fault judgment signal (XV03).

[0041] like Figure 4 As shown, the control unit 122 includes a switch 1221, wherein the first input terminal of the switch 1221 receives the TAB control signal (XQ01) output by the previous processor, the second input terminal of the switch receives a safety value, such as 100%, and the control terminal of the switch 1221 receives a communication fault judgment signal (XV03).

[0042] The following is combined Figures 2 to 4 Explain the process of communication fault protection in this steam turbine control system: For the second processor 12, when no communication failure occurs, the life signal (X51) received from the third processor 13 is a high-low level switching signal. Whether it's a high-level or low-level signal, the duration is less than the delay time of the two power-on delay devices 1212 and 1213 (i.e., the first preset time, for example, 10 seconds). Therefore, the OR gate 1214 outputs a low-level signal. After this low-level signal is latched by the latch 1216, the output communication failure judgment signal (XV03) is low. At this time, the switch 1221 does not perform a switching action; that is, the TAB control signal (TAB) output to the first processor 11 is the TAB control signal (XQ01) received from the third processor 13.

[0043] When a communication failure occurs in the second processor 12, the life signal (X51) received from the third processor 13 becomes a low-level signal. When the duration of the low level is greater than the delay time of the two power-on delay devices 1212 and 1213 (e.g., 10 seconds), the OR gate 1214 outputs a high-level signal. After being latched by the latch 1216, the output communication failure judgment signal (XV03) becomes high. At this time, the switch 1221 performs a switching action, that is, the TAB control signal (TAB) output to the first processor 11 is a safe value (100%).

[0044] When the communication failure of the second processor 12 is resolved, that is, when the life signal (X51) received from the third processor 13 is again a high-low level switching signal, the output signal of the OR gate 1214 changes from low level to high level, and the duration of this high level is greater than the delay time of the power-off delay device 1215 (i.e., the second preset time, for example, 20s), the power-off delay device 1215 outputs a high level signal. After this high level signal is latched by the latch 1216, the output communication failure judgment signal (XV03) changes to low level again. At this time, the switch 1221 switches back to the signal input at the first input terminal, that is, the TAB control signal (TAB) output to the first processor 11 is the TAB control signal (XQ01) received from the third processor 13.

[0045] In summary, the second processor 12 collects the life signals sent by the third processor 13 in real time. If a signal interruption is detected, a fault diagnosis process is initiated. During this process, if an interruption of the life signal is confirmed, a timer for a first preset time is started. After the timer expires, a "temporary fault signal" is output, and the TAB control signal output by the second processor 12 switches to 100%. When fault recovery is detected, monitoring continues for a second preset duration, then the temporary fault signal is cleared, and the TAB control signal output by the second processor 12 returns to the tracked normal signal.

[0046] Finally, it should be noted that in other embodiments, in addition to the second processor 12 including a communication fault protection module, the third processor 13 may also include a communication fault protection module. In this way, when the third processor 13 is disconnected from the network, it determines a communication fault by monitoring the life signals of the second processor 12 and triggers the output TAB control signal to a safe value. In this dual-redundancy fault protection scheme, since each processor has self-fault handling capabilities, the fault tolerance redundancy is higher, making it suitable for units with extremely high fault tolerance requirements.

[0047] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A communication fault protection method for a steam turbine control system, applied in a processor of the steam turbine control system, characterized in that, The communication fault protection method comprises: A monitoring and judging step: monitoring a communication signal between the processor and a previous processor, and judging whether there is a communication fault between the processor and the previous processor according to the communication signal, wherein the steam turbine control system comprises a plurality of processors connected in a chain; A first control step: when there is a communication fault, switching a TAB control signal output by the processor to a safety value, wherein the safety value is greater than zero; A second control step: when there is no communication fault, outputting a TAB control signal output by the previous processor to a next processor.

2. The communication fault protection method of claim 1, wherein, The judging whether there is a communication fault between the processor and the previous processor according to the communication signal comprises: Judging whether there is a disconnection between the processor and the previous processor according to the communication signal; When there is a disconnection, judging whether a duration of the disconnection is greater than a first preset time; When the duration is greater than the first preset time, determining that there is a communication fault between the processor and the previous processor.

3. The communication fault protection method of claim 2, wherein, The second control step comprises: When there is no communication fault, waiting for a second preset time, and then outputting the TAB control signal output by the previous processor to the next processor.

4. The communication fault protection method of claim 1, wherein, The monitoring the communication signal between the processor and the previous processor comprises: Monitoring a life signal transmitted between the processor and the previous processor; or Monitoring a communication message transmitted between the processor and the previous processor, and counting a packet loss rate of the message.

5. The communication fault protection method of claim 1, wherein, The switching the TAB control signal output by the processor to the safety value comprises: Switching the TAB control signal output by the processor to 100%; or Switching the TAB control signal output by the processor to a control value cached before the communication fault occurs.

6. A communication fail-safe module for a steam turbine control system, for use in a processor of the steam turbine control system, the communication fail-safe module comprising: The communication fault protection module comprises: A monitoring and judging unit, configured to monitor a communication signal between the processor and a previous processor, and judge whether there is a communication fault between the processor and the previous processor according to the communication signal, wherein the steam turbine control system comprises a plurality of processors connected in a chain; A control unit, configured to output a TAB control signal output by a previous processor to a next processor when there is no communication fault, and switch a TAB control signal output by the processor to a safety value when there is a communication fault, wherein the safety value is greater than zero.

7. The communication fault protection module of claim 6, wherein, The monitoring and judging unit comprises a NOT gate, a first power-on delay device, a second power-on delay device, an OR gate, and a latch, wherein an input end of the NOT gate and an input end of the first power-on delay device are connected to the communication signal, an output end of the NOT gate is connected to an input end of the second power-on delay device, an output end of the second power-on delay device is connected to a first input end of the OR gate, an output end of the first power-on delay device is connected to a second input end of the OR gate, an output end of the OR gate is connected to an input end of the latch, and an output end of the latch outputs a communication fault judgment signal.

8. The communication fault protection module of claim 7, wherein, The monitoring and judging module further comprises a power-off delay device connected between the output end of the OR gate and the input end of the latch.

9. The communication fault protection module of claim 7, wherein, The control unit comprises a switch, wherein a first input end of the switch inputs a TAB control signal output by a previous processor, a second input end of the switch inputs the safety value, and a control end of the switch inputs the communication fault judgment signal.

10. A turbine control system comprising a plurality of processors connected in a chain communication, characterized in that, The processor comprises the communication fault protection module according to any one of claims 6-9.

11. The turbine control system of claim 10, wherein, The last processor is a processor with a communication fault self-holding function; The processor in communication connection with the last processor comprises the communication fault protection module according to any one of claims 6-9.

Images